I am trying to get shared key between Firefox extension and a java program running in same machine. I am communicating both application via socket.

My assumption is that malware is running in machine which can read any files in machine and also read any port communication. This means i cannot use SSL to secure the communication as I cannot store private key any were in my machine.

For key exchange i am planning to user Diffie–Hellman key exchange. How can java application (listening to a port) can authenticate or be sure that Firefox extension has initiated the key exchange interaction and not some malware?

  • 1
    Short answer: It's impossible. If your application is running on the same machine with a sufficiently privileged malware, you're doomed. – CodesInChaos Nov 15 '13 at 12:33
  • i assume malware can only read files, and also send some thing to port. Still doomed?? – amit Nov 15 '13 at 12:36
  • How are you assuming this theoretical (or real?) malware can only read files? Is it running as the same privileges as Firefox (and thus can read any file that Firefox can)? What are you really trying to secure here? If there is malware on the machine, it can potentially be intercepting anything this other process does (not just socket comms and files), protecting a process on a machine that's already compromised is ultimately impossible. – gregmac Feb 6 '15 at 23:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.