All geek questions in one place

Diffie Hellman in Silverlight

I am trying to develop a security scheme for encrypting application level data between the silverlight client and the php web service I created. Since I am dealing with a public website, the information that I retrieve from the service is publicly available, but the information I submit to the web service is not publicly available. There is also the flip side to the administration website, so naturally, all application data that is pushed and pulled from the web service to the end of the silverlight administration should also be encrypted.

Silverlight does not support asymmetric encryption, which will work on a public website. Symmetric encryption will only work on the rear panel, as users do not access a public website, therefore, passwords cannot be displayed. Still symmetric encryption would be great, but I cannot safely store the private key in the silverlight client. Because it either needs to be hard-coded or read from some configuration file. None of this is considered safe. So ... plan B ..

My final option would then be to implement the Diffie-Hellman algorithm, which supports symmetric encryption using key agreement. However, Diffie-Hellman is vulnerable to man-in-the-middle attacks. In other words, there is no guarantee that both parties are sure of each other's identity, which allows you to intercept and change the connection if the receiving party does not know about it. Therefore, it is recommended that you use a private shared key to encrypt a handshake with key agreements to confirm the identity of either party.

This brings me back to my original problem, which led me to use Diffie-Hellman, how can I use the private key in the silverlight client without hard-coding it either in the code or in the xml file.

... - ?

EDIT:

, - PHP, .

RSA, Silverlight. DiffieHellman Silverlight - PHP, , ( ).

, , , - , (MITM). , ; , silverlight webservice ( , URL-).

, " api" -, .

, - , , , -. , . .

- ?

+3
3

WCF SSL TLS , .

+1

SSL/TLS , Diffie-Hellman, , , " " .

, TLS , , , , , , - , VeriSign. " " VeriSign - , , , , , .

, , TLS. , , . , , , .

: , - SSL/TLS, " " . TLS, , , .

EDIT: : RSA Silverlight -, , , , , , /, , (, , , ). , API -.

SSL/TLS - , - , ; , 100% , , , , .

, , , , , , , , - , / , - , , -.

, -, API , .

+3

JavaScript + PHP DH Exchange: http://enanocms.org/News:Article/2008/02/20/Diffie_Hellman_key_exchange_implemented

javascript silverlight. Wireshark , Meld - , , , .

!

( : Enano dev, SSL SSL, ).

0

Source: https://habr.com/ru/post/1742385/

More articles:


All Articles