1

I have a private client/server application that trying to secure the data transmitted through public network. The encryption/decryption method is private too. Client and server uses DH key exchange to agree a small size (8 bytes) session data key. This 8-byte session key is used to encrypt/decrypt the data.
Since Encrypt/Decrypt method is private (derived from TDES), how secure is the data in public network?

Improve this question

1 Answer 1

Reset to default
1

If by "private client/server" you mean "nobody but me has access to them", what you're doing seem to be overkill. And since your Encryp/Decryp method is private and derived, it may weaken the encryption if not implemented correctly.

This seem to be a classic case for a symmetric key encryption; just generate a 128/256 bit master AES key, and embed it in both binaries. Generate an encryption key+IV on client, and send it to the server with a checksum, encrypted by your master AES key. Then use it for communication. No need for DH.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .