views:

317

answers:

1

Hi,

This goes along with another thread, here: How to implement Java 256-bit AES encryption with CBC

Mainly, trying to get AES encryption on a phone using Java.

My question here is how to handle the encryption key. I don't know if I should store the key, hash the key and use that, or do a public-key-encyption scheme. I would rather have a way to not do an initial message from the server to the phone to communicate a key. I want the phone to be ready to encrypt and the server waiting for an encrypted message. To implement something like a key-sharing algorithm, I would have to modify our server application which is not very desireable. It's not impossible, but I'm going for code-reuse here =).

A: 
erickson
@erickson, about the first part, not trying to store the same key on every phone. Would like to be able to generate some kind of key both the sever and phone know before the actual encrypted string is sent on the wire. Have no idea if that is possible with my limited encryption knowledge. All I know is that the way encryption is implemented now in our applications, we use 1 secret key for everyone stored on the phone and the server. That's bad as far as I know.
Steven Wright