Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I am looking for some information on encryption. Here's what I'm trying to do:

  • Get unique information from our customer (an ID or something)
  • Generate and encrypt some data on our side (using the clients ID)
  • Send this data to customer, and allow an application to decrypt (and decrypt only) this data using the ID sent before

What methods should I be looking at?

Kind regards

To clarify:

  • We encrypt some data using our private key and our clients public key
  • The client decrypts this data using their public key
  • The client must not be able to encrypt valid data using their public key
share|improve this question
    
Are you using HTTP as the transmission medium? –  billy.bob Apr 13 '11 at 8:07
    
Is this ID the key the customer will use to decrypt the data? –  Steve Haigh Apr 13 '11 at 8:19
    
Transmission of the decrypted data can be done using HTTP, e-mail or a stampit note. Same goes for the clients public key. –  SaphuA Apr 13 '11 at 8:44
    
I'm not sure why you want to encrypt the data like this. It will allow anyone to decrypt it. Anyone could have the client's public key, so anyone could decrypt the data. What is your aim in encrypting data in this way? –  Matt Ellen Apr 13 '11 at 14:26
    
security.stackexchange.com and crypto.stackexchange.com may be better places to ask questions about encryption. –  David Cary Jun 28 '12 at 16:19

2 Answers 2

up vote 8 down vote accepted

You want a public-private key infrastructure

From your question you seem to be looking at a public-private key infrastructure (PKI). The ID your client sends is their public key and is totally free to view by anyone. Your servers encrypt the data using a combination of your private key and their public key. This encrypted payload is then sent back to the client. They then use their public key and private key combination to open it. They know it can only have come from you because your private key has signed it to say so and they trust that only you have that private key.

You want to make sure that your clients look after their private key, but that's a matter for them and their operating system.

For a general overview of how PKI works, Wikipedia has a nice article about it. For exact details of an implementation, see OpenPGP in RFC 4880.

Google Keyczar offers a nice and simple API approach to PKI. You can easily generate secure server-side public and private keys and update them if an older one becomes compromised. They don't handle key distribution, but it gives you a starting point.

Updated in light of revised question

If the client attempts to submit their own encrypted data it can only have been generated by their own private key. This will fail the signature test on your servers since you will only accept encrypted data created from your own private key.

share|improve this answer
    
Thanks. While informative, I'm not looking for an API. I'm looking for information about recommended encryption methods that fit this exact scenario. –  SaphuA Apr 13 '11 at 8:17
    
@SulphuA - The answer recommend PKI, there are many implementations available depending on your platform. –  Steve Haigh Apr 13 '11 at 8:23
    
@Steve, gary edited his answer after my comment ;) –  SaphuA Apr 13 '11 at 8:28
    
@Saphua So if anyone is able to decrypt it without causing aproblem, then it seems that you actually need a trusted signature instead of encryption –  Gary Rowe Apr 13 '11 at 8:39
    
@Gary, not realy. The data is required on the client side, it's just not a big deal if they decrypt it, as long as they are not able to decrypt their own data. –  SaphuA Apr 13 '11 at 8:43

To clarify:

  • We encrypt some data using our private key and our clients public key
  • The client decrypts this data using their public key
  • The client must not be able to encrypt valid data using their public key

It's more like:

  • You encrypt data using your private key and client's public key
  • Client decrypts using your public key and his private key
  • Client doesn't have acces to your private key, thus cannot create data that would be valid decrypting with you public key.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.