I am developing an application that uses ECIES encryption and I am currently storing private keys in secure place on each peer and storing public keys in a shared database (accessible by all peers). Is this a problem?

Logically knowing a public key of some peer allows me to send him a message, and no risk because the private key is unknown. Can someone explain to me whether this approach is secure?

  • 2
    $\begingroup$ The more interesting problem is probably who can modify the public data base and how are (changed) public keys verified? $\endgroup$ – SEJPM Nov 22 '19 at 12:43
  • $\begingroup$ Peers are not allowed to change the stored public data, they can only add new public keys $\endgroup$ – SAliaMunch Nov 22 '19 at 12:47
  • $\begingroup$ The database would need to include not only the public key, but also the identity of the owner of the public key. What if the attacker added a new public key, associated with the identity of someone else? Also, how does someone update their public key? Could someone else do that same procedure? $\endgroup$ – poncho Nov 22 '19 at 13:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.