4
$\begingroup$

I'm writing an application for controlling computers from a client.

I'd very much like it if the connection is secure and only authenticated clients are allowed access.

The workflow will be something like this:

  1. A client use decides to add the server
  2. The server allows the client
    1. Alternative 1; On the server screen a X digit code is displayed that the client has to enter.
    2. Alternative 2; The server presents a dialog which the server user has to accept.
  3. The client and server exchanges keys to remember each other.

I understand that this initial communication won't be 100% secure unless the user manually verifies it, what's important is that future communications are secure.

What are good ways to make this as secure as possible?
None of the data sent is ATM sensitive so as a worst case only authentication is required.

If possible I would like to use HTTP(S) as the protocol.

Improve this question
$\endgroup$

1 Answer 1

Reset to default
3
$\begingroup$

What you are looking for is how to implement an SSL/TLS layer on top of your TCP connection. Try to use the OpenSSL library, it's the most popular implementation.

Improve this answer
$\endgroup$
2
  • $\begingroup$ So I guess the client would fetch the remote certificate and store it to verify the server while the client will add some secret to the server which it uses to verify the client. $\endgroup$
    – Nicklas Ansman
    Commented Jan 20, 2014 at 10:16
  • $\begingroup$ The certificate verification can be handled by the container/framework you're working on. For instance, in Java it's been done by the trustManager, here is a nice Java SSL/TLS implementation example $\endgroup$
    – Theofilos Papapanagiotou
    Commented Jan 20, 2014 at 12:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.