Is there another way to verify someones public key without a CA signing it? A challenge-response authentication including some sort of UID of the smartphone?

  1. Smartphone A generates asymmetric key pair
  2. A sends public key K1 via internet to Smartphone B
  3. B recieves a public key K2

How can B be sure that K2 = K1 ?


1 Answer 1


Without a CA, you need some type of other secure secret exchange. It could be a side channel exchange of the thumbprint or use of some pre-existing shared secret. Web of trust can also be used, though this is basically another form of side channel.

Using the UID as you suggest however, is likely insecure. The UID of a phone isn't a secret and an attacker could obtain the UID and then impersonate the device.

Now, if you don't actually care about the identity of the phone, it could just submit an anonymous public key and you will know that it is the same phone in the future, but you will know nothing about the identity of that phone. You don't need to involve the UID (and shouldn't) for that though.

  • How would you establish the side channel exchange and the exchange of the preshared key? Probably with PKI.. +1 for Web of Trust though.
    – Michael
    May 12, 2014 at 14:19
  • @Michael - it depends on the situation. Possibly via a phone call, possibly via a notary public, possibly via sending a courier and/or driving to the other person yourself, possibly a facebook login, possibly something else entirely. It really depends on the level of security needed. PKI makes life easier, but it isn't a necessity, especially for small situations. May 12, 2014 at 14:23
  • Indeed, in those examples there is actually always a trusted third person (unless you deliver it yourself). But you are right, it does not have to be a CA.
    – Michael
    May 12, 2014 at 14:29
  • Phone call isn't a trusted third party if you know their voice. Similarly, depending on what you are trying to authenticate, something like a facebook login wouldn't be a trusted third party, so long as all you want to know is that they have control of that account. May 12, 2014 at 14:44
  • +1 because you made a clear point about side channel exchange
    – David
    Dec 29, 2016 at 11:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .