4

I am writing an application that occasionally needs to transmit larger messages to other servers on the internet without allowing people to snoop on the traffic. The normal way to handle this is to get an SSL certificate and use an encrypted connection for the communication channel.

However, trusted certs cost money and I don't want to require my users purchase one to transmit data.

Currently, I'm trying to decide if using self-signed certificates or PGP would be a better idea. If I use PGP I can just have the servers pass each others public key back and forth before they send the data.

What is the proper way to use free encryption for something like this?

| improve this question | |
4

Why would you use PGP if you can just sign the certificates with your own generated root certificate and just add the public root certificate to all your participating servers/clients?

| improve this answer | |
  • I forgot to mention that I want to be able change certificates if needed. I also don't control these other nodes so I need to be able to pass my cert or public key when they are needed. This isn't really about nodes trusting each other, just having a private conversation. – Xeoncross Oct 26 '12 at 19:17
  • So how do you plan to safely exchange your public key (so the other node knows for sure it's in fact your public key)? The problem is the same for SSL as openPGP... – Lucas Kauffman Oct 26 '12 at 19:21
  • Assuming node A wants to send data to node B, node A calls B and asks for it's public key (and caches it). Then node A calls back node B and gives the data to node B. node B then calls up node A and asks for it's public key so it can decode the data that A gave it (and caches it for a bit). Let me know if this wrong. :) – Xeoncross Oct 26 '12 at 19:25
  • Hey, I'm node A (trust me!). My public key is 0xF00. ;) – Henning Klevjer Oct 26 '12 at 19:28
  • 1
    "Hello I'm node C, today I will put myself between node A and B and take on node A his IP. I will keep passing messages to node B, but not before reading all the messages. I will tell node A I'm B and I'll tell node B I'm A." There is no way you will be able to tell if someone is doing a MITM if you do not have a certain web of trust (safe distribution of public keys) – Lucas Kauffman Oct 26 '12 at 19:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.