Is SignedObject Safe to Deliver to Client Applications

Question

SignedObject  (Serializable  object, PrivateKey  signingKey, Signature  signingEngine)

Is it safe to serialize and deliver this object to the client application? Is there a way they can take possession of PrivateKey through reflection?

I want to use this object to store a digital signature, as well as for data that has been signed.

Answer 1

Serialized objects include only the object itself and the signature (and the algorithm used for signing purposes), as indicated here:

http://java.sun.com/j2se/1.4.2/docs/api/serialized-form.html#java.security.SignedObject

. , , , ( ).

Answer 2

Java :

http://java.sun.com/javase/6/docs/technotes/guides/security/crypto/CryptoSpec.html