4

I am developing a messaging application, more like a chat, in python just to teach my self how sockets work and to learn more about cryptography in general by using PyCrypto.

About my application:

The main purpose of this application cryptographic-wise is to secure messages sent over internet using an asymmetric encryption. Since I am doing this to increase my knowledge concerning cryptography I want it as secure as possible. In this application a client connects to a server and is added to a list holding all currently connected users. The client can now send a message to the server which echoes the message out to all other connected users.

My question:

As a small disclaimer: I am fairly new to encryption in general and there is a couple of things I cant wrap my head around. I cant quite figure out how I should distribute the public keys so that an asymmetric encryption can be used to secure messages sent to the server. From what I've read, there is supposed to be some kind of a server I can retrieve generated keys from but I cant seem to find such a service.

Also, if I would be able to retrieve a public key from a key server, how should I generate a private key so that it can be decrypted?

All help, suggestions and corrections are greatly appreciated!

-Tommy

Improve this question
1
  • 1
    I recommend that you study the concepts behind public key infrastructure and web of trust. Apart from that the use of of Python in your case is only an implementation detail which is not relevant to the conceptual question you ask. Therefore I removed these tags.
    – Steffen Ullrich
    Mar 13, 2017 at 5:41

1 Answer 1

Reset to default
1

A simple solution would be for each client to encrypt messages sent to the server using the server's public key, which is usually sent to the client as part of connection negotiation. The server can then decrypt the client's message using its private key, and then re-encrypt it using the private key to distribute the message back to the other clients - who can then read the message using the server's public key to decrypt.

'Better' solutions would involve distributing each the public keys of all connected clients as part of the initial handshake. The client would need some means of knowing how to associate a public key with the message sender which means that there is some information leakage outside of the encrypted text. This is better because now the server can be compromised and the information being transmitted is still safe, but comes at the cost of slower connection speeds and additional complexity.

Improve this answer

You must log in to answer this question.