Share and store RSA - public key in java server and vice versa

Question

My requirements are:

Requirement 1: Share public key to java server.

Steps:

1. Generate public-private keys in iOS app.
2. Store the generated keys in keychain.
3. Send generated public key to java server.
4. Java server shall be able to store shared public key in database.

Requirement 2: Store public key sent by java server.

Steps:

1. Java server sends public key of other user.
2. Process data sent by java server and generate public key from it.
3. Store generated key in keychain, which can be later retrieved for encrypting message to be transferred.

I am able to achieve steps 1-2 in requirement 1 by using below method defined in SecKeyWrapper class (CommonCrypto sample):

- (void)generateKeyPair:(NSUInteger)keySize

Question 1: Now problem is- how shall I send that key to java server?

We have getPublicKeyBits method in the same class, which returns an NSData object, on some googling I found that it is in DER encoded format.

Question 2: If I send the same NSData object to server, which I guess it will interpret as ByteBuffer object, will it be possible for other devices, in my case it could be android, to interpret that data?

Question 3: What is the best way to share public key in above scenarios?

Answer 1

Java servers and Android apps expect the public key in X.509 format, see http://blog.wingsofhermes.org/?p=42 on how to convert.

Answer 2

You should:
* Use netty.io for data sending
* Use a serialising and de-serialising mechanism using ByteArrayStreams and ObjectStreams
* Use some sort of encryption like using AES with a passphrase

netty.io: Same as what the screencast said but change the handlers to fit your needs, use ByteEncoders and ByteDecoders. https://www.youtube.com/watch?v=tsz-assb1X8&t=523s
Serialization:
Encoder:
public static byte[] serialize(T object) throws IOException { ByteArrayOutputStream bOutputStream; ObjectOutputStream objectOutputStream; bOutputStream = new ByteArrayOutputStream(); objectOutputStream = new ObjectOutputStream(bOutputStream); objectOutputStream.writeObject(object); objectOutputStream.flush(); byte[] bytes = bOutputStream.toByteArray(); bOutputStream.close(); objectOutputStream.close(); return bytes; }

Decoder:
@SuppressWarnings("unchecked") public static T deserialize(byte[] bytes) throws ClassCastException,IOException, ReflectiveOperationException { T obj; ByteArrayInputStream bInputStream; ObjectInputStream objectInputStream; bInputStream = new ByteArrayInputStream(bytes); objectInputStream = new ObjectInputStream(bInputStream); obj = (T) objectInputStream.readObject(); bInputStream.close(); objectInputStream.close(); return obj; }

AES: It's like two classes but it's quite easy. You can search it up on stack overflow or something

Storing:
Map < Integer, PublicKey> or whatever should do the trick.