Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to implement an AES encryption on my messages in my app and I want to have a different keystream for each "message group". Therefore, currently I am holding the keystreams in the database of the message groups. And the messages get decrypted by the app. However, there is one problem. The app is talking to the server via REST, and I need to get the encryption keys in a secure way. I am thinking of another keystream to encrypt the keystreams of message groups but I don't know where to keep it. Should I keep it in the app?

share|improve this question
Your concept does not sound like a good idea from a security standpoint – Richie Frame Aug 4 '14 at 7:14
Are you sure you mean keystream? – otus Aug 4 '14 at 7:38
maybe I am getting the terminology wrong; what I mean is the text to encrypt the data. – Gasim Aug 4 '14 at 8:23
up vote 3 down vote accepted

You should never keep keystreams. You should keep a key, and store an IV or Nonce with the ciphertext. You first need to think about where to store the key, if you store it in the same location or with the same security as your ciphertext, your scheme is meaningless.

Check this answer I just created on Stackoverflow, and learn about key management. This answer on the Information Security site also seems very on topic for you.

share|improve this answer
I am going to check this one out. The PGP system sounds very promising. – Gasim Aug 4 '14 at 8:24
For a Public Key Infrastructure (PKI) that uses a hierarchical model (often more useful for servers, you know, with CA & root certificates) check out CMS instead of PGP, which uses a web of trust. – Maarten Bodewes Aug 4 '14 at 11:41
I have googled a lot and found a free cryptography book. Currently reading it, getting familiar with the concepts, terminology, and techniques. Cryptography has always been an area of interest of mine, so I guess now its time to use it :) – Gasim Aug 5 '14 at 12:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.