I initially posted this on StackOverflow, and was redirected here. I have been playing around with Bouncy Castle (Java) for the last few days, and I've reached the point where I believe I can securely exchange secret keys with a Diffie-Hellman exchange.
Having read many posts underlining the difficulty of properly implementing a cryptographic exchange, I would like your honest opinion on my work. All the underlying cipher operations are based on Bouncy Castle and may therefore be deemed reliable.
String message = "Hello World"; AESCipher aes_client = new AESCipher(256); RSACipher rsa_server = new RSACipher(2048); // (Public key sent over the wire) RSACipher rsa_client = new RSACipher(rsa_server.getPublicKey().getModulus(), rsa_server.getPublicKey().getExponent()); // The client encodes his AES key with the RSA public key: byte aes_key = rsa_client.encode(aes_client.getKeyBytes()); byte aes_iv = rsa_client.encode(aes_client.getInitializationVector()); // (Data sent back over the wire) byte decoded_aes_key = rsa_server.decode(aes_key); byte decoded_aes_iv = rsa_server.decode(aes_iv); // The server creates an AES server which uses the client key: AESCipher aes_server = new AESCipher(decoded_aes_key, decoded_aes_iv); byte encoded_message = aes_client.encode(message.getBytes()); byte decoded_message = aes_server.decode(encoded_message); System.out.println(new String(decoded_message));
Can this exchange be considered safe? Should I be sticking with SSL Sockets, eventhough it'd hurt to thrash my hard work? Thanks in advance for your input!
(By the way, my Bouncy-Castle-Wrapping-Library is totally open-source, so just let me know if you want the repository's URL.)