2

I am working on a java program and I am now working on its network security. I want to use a secure connection since it transfers a lot of sensitive information. On all security guides it is mentioned to always go with a standard way and dont use your own encryption/way.

Are there any security issues if I use my own public/private key pair without it being a trusted certificate? I understand that an attacker can send its own key during the exchange but what if the key is standard and I hardcode it into the code?

3

With SSL, the client must use the server's public key, and it must have a way to make sure that it is using the right server key, not a fake one sent by some attacker on the network path. That's what certificates are about. If you cannot trust the information in the server's certificate, then... you cannot trust it, and you lose.

If you know the server's public key in advance, and can hardcode it in the client code, then you actually trust it, and that's fine (although not very flexible). A hardcoded server certificate value is, in fact, a very reduced PKI.

1

Are there any security issues if I use my own public/private key pair without it being a trusted certificate?

I presume you mean "signed by a known certificate authority" when you say trusted? Yes absolutely!

Remember though, don't roll your own protocol. Use SSL/TLS. Create your own certificate authority with a tool like openssl and use it to sign SSL certificates for the client and server.

0

As oppose to @Terry I'm going with. No, not at all or maybe not.

It will depends on the use you are going to give to this application, if it is personal then, why would you pay some CA to make your pair "trustworthy"?

Au contraire, if you are planning to go "public" with "public" users if you don't use a trusted CA your users will receive a BIG warning when accesing your app.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.