1
$\begingroup$

I'm new in terms of encryption and I have to encrypt the data between two Java Spring applications, one have serves as MVC framework and other as Web Service, I'm implementing an asymmetric encryption by generating the private and public key with RSA at the beginning of the deployment cycle and saving the keys in binary files locally in the hard drive but I’m not sure if that is the best way of doing it, and then I have to share the public keys between the two projects automatically but I don’t know how should I do this, I was planning to exchange the keys by sending a petition to the Web Service.

I'm using the KeyPairGenerator class to get a KeyPair and writing the PrivateKey and PublicKey objects to local disc.

|improve this question
$\endgroup$
  • $\begingroup$ Do you have a communication channel between the servers that can be assumed to not tamper with data transported? Would the loss of a private key (in terms of availability) be a major problem? Do you require user / admin interaction at application startup? Do you have a HSM / TPM on the server running these services? $\endgroup$ – SEJPM♦ Jul 19 '18 at 17:10
  • $\begingroup$ @SEJPM The spring MVC application is consuming the Spring boot application with REST petitions via POST, but no, I don't have a secure communication channel between the servers, yeah It would be a major problem, No, I don't require user/admin interaction, I don't have a HSM/TPM server running. I can only generate public/private keys in both Spring applications but don't know how to do the public key distribution $\endgroup$ – Carlos Robles Jul 19 '18 at 22:54

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.