cannote receive the symmetric key...:(

hey everyone,

i am using a pub/priv key pair to exchange messages from a client to a server using certificates. There comes a time when i want to send a symmetric key from the server to the client and switch to symmetric encryption. This packet should contain the symmetric key signed and encrypted..

In my server i create a symmetric key as follows:

SecretKey symmetricKey=null;

try{

KeyGenerator kg = KeyGenerator.getInstance("DES");

kg.init(new SecureRandom());

symmetricKey = kg.generateKey();

}catch(Exception e){

System.out.println("Exception "+e);//fix it

}

in the message that should contain the symmetric key i do the following

pcktSymmetricKey.setSignature(sign((new String(symmetricKey.getEncoded())), myPrivateKey));

pcktSymmetricKey.setMsgEncrypted(encryptAsymmetric(symmetricKey.getEncoded(),clientPublicKey));

DatagramPacket sentPacket2 = serializeObject(pcktSymmetricKey);

socket.send(sentPacket2);

in the client side i declare a SecretKey using the following (and this may be the problem

SecretKey symmetricKey=null;

and then when i receive the packet i do the following :

pcktSymmetricKey=(MyPacketMessageEncrypted)deserializeObject(receivedUdpPacket);

byte[] decryptedMsg2=decryptAsymmetric(pcktSymmetricKey.getMsgEncrypted(), myPrivateKey);

boolean statusSignature2=checkSignature(pcktSymmetricKey, decryptedMsg2, serverPublicKey);

System.out.println("status of the signature of the symmetric key :"+statusSignature2);//this prints TRUE!

and the problem is here.. i cannot find a way to import the symmetric key that is now decrypted in the decryptedMsg2 in bytes and set it to the symmetricKey variable... i am trying to find a way to use the SecretKeyFactory but i cannot make it work.. how should i initialise the SecretKey or the SecretKeyFactory and how should i convert the bytes that hold the symmetric key to store it to a variable and use it later with symmetric cryptography..?

many thanks!!

[2587 byte] By [panosjavaa] at [2007-11-26 20:54:47]
# 1
> i am using a pub/priv key pair to exchange messages> from a client to a server using certificates. Secure sockets (SSL) does exactly this - http://java.sun.com/products/jsse/ .
sabre150a at 2007-7-10 2:22:05 > top of Java-index,Security,Cryptography...
# 2
... and a lot more besides, including closing numerous security holes that you're probably not even aware of. Don't reinvent the wheel.
ejpa at 2007-7-10 2:22:05 > top of Java-index,Security,Cryptography...
# 3

> //this prints TRUE!

And what does it mean? Succeded or failed? You shoud use a better name instead of checkSignature.

I transfer a public key this way and I use the following:

final KeyFactory keyFactory = KeyFactory.getInstance("RSA");

keyFactory.generatePublic(new

X509EncodedKeySpec(bytes));

Something like that should also work for you.

Maaartina at 2007-7-10 2:22:05 > top of Java-index,Security,Cryptography...
# 4
this means that it succeeds:) yes sometimes my names are not that good...hmm i will try to use this with my DES key...
panosjavaa at 2007-7-10 2:22:05 > top of Java-index,Security,Cryptography...