0

I need to send encrypted and dedicated data to a mobile application (ios/android) supposing that the application is not connected to internet.

My current idea is to send the data through a QRCode containing the encrypted data. I don't want to use symmetric encryption and "share secret" on both sides for obvious security reasons.

I'm a beginner in encryption ;-)

I think that it can be acceptable that the application generates a 16 characters that the user can enter into a web form and then download the QRCode dedicated for this device and encrypted.

Then my feeling is that I'm looking for an asymetric algorithm that can be initiated starting from something like 16 characters.

It's acceptable that the application knows the server public keys, but application won't have possibility to send more that 16char to share their locally generated public key.

Any idea?

4

1 回答 1

0

您的 16 个字符听起来像是一次性密码，您可以从中派生对称加密密钥。由于它是一次性密码（除非用户一次又一次地重复使用此密码），因此使用它的风险不大。此外，您不要将此密码（或派生密钥）存储在服务器上以防止泄漏。

密钥可以使用PBKDF 函数导出。用户密码的长度是最重要的——它必须尽可能长（16 个字符是相当弱的密码）。

于 2013-07-27T15:31:29.770 回答