0

I found a very good public private key encryption tutorial here. This tutorial uses an RSA public key algorithm and the AES shared key algorithm.

I am thinking of designing a client,server architecture where the client keeps the private key, the server keeps the public key. The username + salt is encrypted by the private key and sent to the server along with the AES shared key. The server uses the AES Shared key + Public key to decrypt the information. Is this method secure ? Is there any better way to use Public-Private-Key authentication ?

5
  • Why not use TLS? For secure communication it's almost always a better choice than custom crypto. Jun 20, 2014 at 10:27
  • Can you provide a link ? Whats the difference between the two ?
    – AndroidDev
    Jun 20, 2014 at 10:29
  • 1
    TLS is a higher level protocol designed for secure communication. You're attempting to design your own protocol instead of using an existing protocol. Designing a good protocol is tricky and requires experience with cryptography. Consider forward secrecy, server authentication, active attacks on your encryption such as padding oracles, replay attacks, which padding you use for RSA, which mode of operation you use for AES, how you generate the IVs and many more details. If you even get a single one of these wrong, your security breaks down. Jun 20, 2014 at 10:31
  • If you need only to authenticate securely, then SRP is probably one of the most advanced choices you have. Check SRP home and wiki. Jun 20, 2014 at 11:37
  • This question appears to be off-topic because it is about cryptography. First describe the protocol using formal language, check for dupes and post on security.stackexchange.com . Or use a premade format such as CMS or OpenPGP. Or, if you want transport security, use SSL (TLS). Jun 21, 2014 at 22:20

1 Answer 1

1

I think you are supposed to encrypt information with public key, and then decrypt it with private key of server. Public key from definition is the one exposed to everyone, so in your case everyone can decrypt the message sent from client, including aes key.

1
  • So if i swap the keys, in theory my architecture is secure [enough]?
    – AndroidDev
    Jun 20, 2014 at 10:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.