Hi all.
I'm looking into ways clients can send there password to the server, And its looking like a good bet is RSA.
I was thinking that the clients can encrypt there password with the publickey then send that over the wire.
Q1.That will be safe from anyone but the holder of the private key.
Problem 1. I'm using cryptoPP and when you create a key pair you specify the key size.
Q2.This seams to limit the size of the message you can encrypt based on key size So if you create it say 2048 does that matter too much or should that be kept under 1024 bytes.
Q3.The Publickey can then be shipped with the app is this the norm.
this is a bit of code so far I can create the 2 keys and encrypt and decrypt
.
//rsa private an a public key so users can encrypt the pass but no one can unencrypt
CryptoPP::AutoSeededRandomPool rnd;
CryptoPP::RSA::PrivateKey privKey;
//For demonstration purposes, the program below will use a 64 bit modulus. The modulus is artificially small, and the parameters were generated with the following program
privKey.GenerateRandomWithKeySize(rnd, 1024);
CryptoPP::RSA::PublicKey pubKey(privKey);
//Its always a good idea to validate any loaded keys. The code below validates the private and public keys at level 3,
//which is most thorough (for a full discussion, see Keys and Formats). The check on the public key is redundant since
//the private key is validated. It is shown for completeness
if(!privKey.Validate(rnd, 3))
std::cout << "Rsa private key validation failed" << std::endl;
if(!pubKey.Validate(rnd, 3))
std::cout << "Rsa public key validation failed" << std::endl;
//Next, we want to encrypt the string "secret". In RSA, encryption is simply c = me. So our task is to encode the string as an Integer in preparation for encryption. To accomplish the encoding, we perform the following. (See this example in one file)
std::string message = "secret Dont tell any one this is a long message to see if its going to work so now I dont";// have a job I will worrk on thi9s staff all day to learn and do my game";
CryptoPP::Integer m((const byte *)message.data(), message.size());
//After the above, m (the word secret) is encoded as an integer. We can use C++'s insertion operator to inspect m:
std::cout << "m: " << m << std::endl;
//m: 736563726574h
//At this point, we have n, e, d and m. To encrypt m, we perform the following.
CryptoPP::Integer c = pubKey.ApplyFunction(m);
std::cout << "c: " << std::hex << c << std::endl;
//c: 3f47c32e8e17e291h
//ApplyFunction is the 'easy to compute' transformation. If we look at rsa.cpp near line 65, we see the RSA class performs the expected exponentiation.
// Decryption
CryptoPP::AutoSeededRandomPool prng;
CryptoPP::Integer r = privKey.CalculateInverse(prng, c);
std::cout << "r: " << std::hex << r << std::endl;
// r: 736563726574h
std::string recovered;
recovered.resize(r.MinEncodedSize());
r.Encode((byte *)recovered.data(), recovered.size());
std::ostringstream os;
os << r;
std::string sendinteger = os.str();
std::cout << "recovered: " << recovered << std::endl;
std::cout << "os recovered: " << sendinteger << std::endl;
