I'm building an application and want it to securely transfer data to a server. Thinking to use public/private keys for initial handshake to encrypt a key with which to encrypt subsequent data.

Is it reasonable to have the private key integrated in the executable which will be distributed out in the wild for anyone to reverse-engineer? I also thought of using three-pass protocol, but read about some of its weaknesses and it probably won't work for me

(originally asked in stackoverflow.com, somebody suggested i post it here instead)

  • one question: why not the other way around? Have the Public key of the Server to encrypt (like it should be). – Serverfrog May 3 '17 at 10:50
  • 2
    One question: Why reinvent the wheel? What about TLS (likely as HTTPS), possibly with certificate pinning within your application, does not meet your needs? – a CVn May 3 '17 at 11:02
  • @MichaelKjörling the plan is for additional encryption on top of https. – estoy May 3 '17 at 11:10
  • @Serverfrog client encrypts with server's public key, server response is encrypted with client's public key - isn't that how it works? the question is is it reasonably safe to deploy the client app with the client's private key embedded in the app itself – estoy May 3 '17 at 11:10
  • 2
    @estoy "the plan is for additional encryption on top of https" Why?! What do you think you can do better than the people designing HTTPS, TLS, and the primitives used therein? What, exactly, about your use case is not met by establishing a TLS-encrypted tunnel? – a CVn May 3 '17 at 12:05

To write the Answer from Comment Section:

Generate the Private/Public Keypair on the client, encrypt this with a password (maybe choose from the User itself).

The send the Public Key encrypted via Server Public Key to the Server and you have your entire Public/Private Stack.

| improve this answer | |
  • 4
    You mean reinventing TLS, most likely poorly? – a CVn May 3 '17 at 12:06
  • As he stated for you, he want to use it with TLS. I never mentioned that it was a good way and agree with you but this is the answer for his Question – Serverfrog May 3 '17 at 12:07
  • 1
    indeed, this is the requirement, thanks both for helping out - sounds like a good plan for me – estoy May 3 '17 at 12:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.