CODEWITHSUNDEEP
springspring-securityservercryptographyencryption-asymmetric
androidDeweleper
androidDeweleper

Reputation: 103

How to let client know encryption parameters?

The client has my public key. This is my decryption algorithm on server side

    fun decryptChoice(choice: String, iv: ByteArray): String {
        val privateKey = getPrivateKey()
        val cipher = Cipher.getInstance(transformation)
        val oaepParameterSpec = OAEPParameterSpec(
            MGF1ParameterSpec.SHA512_256.digestAlgorithm,
            "MGF1",
            MGF1ParameterSpec.SHA512_256,
            PSource.PSpecified(iv)
        )
        cipher.init(Cipher.DECRYPT_MODE, privateKey, oaepParameterSpec, SecureRandom())
        val decryptedBytes = cipher.doFinal(Base64.getDecoder().decode(choice))
        return String(decryptedBytes)
    }

Question - How is client supposed to know my what is my transformation algorithm, AlgorithmParameterSpec, etc.

Approach 1 - send this detail everytime with a response

Problem - since these details change rarely, why consuming useless bandwidth

Approach 2 - create a separate endpoint for this config data, either on config server or with server's metadata

Problem - every time a client gets a response, it has to make additional call to server for same data. If client caches it, how to tell client that crypto config data has been updated, if it has. If client still uses outdated crypto config and decryption fails, how to identify if it wasn't a malicious client?

Upvotes: 0

Views: 37

Answers (0)

Related Questions