0

I'm learning cryptography and stuck with a problem. Suppose I have a chat app that uses sockets. Before the massage is sent it's encripted with the RSA algorithm; what are some good strategies to safely pass that public key to anyone with whom a user chats?

My second question is how often a public & private key pairs should be updated.

My guess is that keys should be generated whenever a user chooses someone to send a message to, this way all the dialogues will be encrypted separetly, however I'm clueless about the keys: should they be generated on a server or client

1 Answer 1

2

You should obviously generate keys locally at the device. Otherwise, a compromised server could leak every single key.

Further, why use a key-pair per conversation? That means a lot of keys. One of the public key crypto systems is that you have a public and private key. The public key is used for encryption, and private for decryption. Thus one public key per client would be enough.

There's no need to keep the public keys secret. Send them to the other party in the conversation. You obviously need to control the integrity of them.

You should also look into topics such as forward secrecy, and how to achieve this.

In short: don't implement this yourself. You will mess it up. Use an encryption library and established protocols, such as Signal (for instant messaging), PGP or similar. You will avoid a lot of pitfalls by using well-tested algorithms and protocols.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .