Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I have a client-server application, which is transferring data between its components in a secure way. I currently use AES algorithm with CBC mode to transfer data and file. This is the scenario: Client ask for data(file or plaintext), server takes the request and encrypt data with a iv/key pair and sends encrypted data to the client. Client always stores data encrypted. Client is a per user application. So for this reason, client should open the files, should read data even in offline mode. (Server application is .Net based, Client is Delphi)

What I need is a secret key generation mechanism, that is secure and changeable between client and server, something that is related to the current user ('user1', 'user2' etc). I'm not experienced in cryptography, So I will be waiting for the experienced one's advices.

Thanks in advance

Edit: I will try to explain my problem in more details. We have a client application, that is opening some files in some format (say 3dsmax). Those files are downloaded from a database in server and only authenticated user can download this files. But even if authenticated user download this one, files shouldn't be copied to other computers, disks. because those files contain strictly worked models (say 3d models) and need to be encrypted; and there is another case that when client sqlite database need to be updated, we send scripts to the client in an encrypted way and client decrypts and executes, saves values encrypted.

We do all of this work. Perhaps I asked the question not in a proper way. By key generation I mean that, how do we create a mechanism to securely and consistently exchange the data? Preferably without key storage but some mechnaism that creates the key in runtime but in both sides by using userids, licence keys etc... we store user information both in client and server. I hope I could explain

share|improve this question
1  
You forgot to handle authentication/integrity (a common error), the key generation and storage mechanism is, sadly, irrelevant. Disregarding this, can you state some more of your requirements? What environment is the client executing in, how long does the data need to remain encrypted at rest, do you allow the user to provide a password to decrypt his files, etc.. –  Thomas Dec 3 '12 at 14:09
    
Instead of inventing your own system which is bound to have issues, the first place to start is see what is already available that meets your needs or at least 90% of your needs. I would suggest instead of telling us what solution you have already come up with and asking for help solving one problem that has popped up, describe the application and requirements and ask what is available that might fit your needs. –  mikeazo Dec 3 '12 at 15:34
    
@Thomas added more explanation –  paskalnikov Dec 5 '12 at 8:05
add comment

1 Answer 1

In practice you should use the tools already provided. SSL/TLS and by extension HTTPS are very powerful tools that provide proper implementations of key exchange, authentication and privacy. As far as I can tell this solves all of your problems.

AES-CBC alone is problematic. As Thomas pointed out you lack authentication. A common solution to this problem is using an HMAC and here is a good discussion of HMACs and encryption.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.