I need to do digital signing of my request data which will be sent to the server. My server sends distinct private keys to her clients after authentication and expects all responses to be digitally signed with those keys for next x days. In order to represent a private key instance in iOS it expects a .p12 file with a password input.

Since the private keys change dynamically for every user, I can have a persistent certificate or .p12 on my device to read the private keys. In that case, is it advised to send the .p12 file as part of the JSON response in base 64 format over the wire after authentication, create a .p12 file buffer and do message signing? Is this safe? Or is there any security vulnerability in this approach?

  • 2
    $\begingroup$ No one should be sending private keys over the wire. The correct way would be for the client to generate a key pair and do a certificate signing request to the server (e.g. PKCS10), or at the very least simply send its public key to the server (over an authenticated connection for both cases, of course). $\endgroup$ – user13741 Sep 20 '14 at 23:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.