证书颁发机构与存储的公钥
我正在开发一个 J2ME 应用程序，它可以安全地连接到服务器进行登录。我在两者之间设置 SSL 时遇到了很多困难，所以我想到了一个更简单的解决方案，希望您能对此发表意见。
J2ME Midlet 附带服务器的公钥，在连接时，使用该公钥对消息（用户名、密码散列和随机）进行加密并将其发送到服务器。然后服务器对其进行解密并使用它来验证客户端的身份。
证书颁发机构的主要思想是说谁是谁，如果两方已经知道这一点并同意它不会改变（除非通过已经经过身份验证的连接），那么我是否就不再需要一个证书颁发机构了？
谢谢， 弗拉基米尔
I'm developing a J2ME app which securely connects to a server to login. I'm having a lot of difficulty in setting up the SSL between the two so I thought of a simpler solution and I'm hoping you can give your views on it.
The J2ME Midlet is shipped WITH the server's public key, on connect a message (username, password hash and random) is encrypted using that public key and sent to the server. The server then decrypts it and uses it to authenticate the client.
The main idea of the certificate authority is to say who is who, if the two parties know that already and agree that it won't change (unless through an already authenticated connection), then don't I bypass the need for one?
Thanks,
Vladimir
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
是的，但我认为你没有抓住要点。该程序随密钥一起提供，但用户无法知道他们正在下载的程序实际上来自您，而不是某些恶意黑客拦截/重写通信；用户看到的只是从墙上的电线传来的比特。
通常，您要做的就是用您的密钥对 jar 进行签名，然后将密钥与您的程序一起发送。现在我们遇到了先有鸡还是先有蛋的问题：他们怎么知道钥匙来自你？
这就是证书颁发机构发挥作用的地方； CA 的密钥已经在他们的计算机上，因此他们将其留给 CA 来验证您的身份并签署您的公钥。然后，当用户获取公钥，验证它是否由 CA 签名，并验证 jar 是否由密钥签名时，他们知道密钥是您的，因此 jar 一定来自你，因为你是唯一可以用私钥签名的人。
现在，如果您的密钥提前在他们的计算机上（例如，在公司内部，在设置计算机时密钥实际上放置在计算机上），他们是的，您绝对不需要拥有密钥已签名。
Yes, but I think you are missing the point. The program is shipped with the key, but there is no way of the user knowing that the program they're downloading actually came from you, and not some malicious hacker intercepting/rewriting the communication; all the user sees is bits coming in from a wire on the wall.
Typically what you'll do then is sign the jar with your key, and ship the key with your program. Now we have a chicken-and-egg problem: how do they know that the key came from you?
This is where the certificate authority comes in; the CA's key is already on their computer, so they leave it up to the CA to verify who you are and sign your public key. Then when the user gets the public key, verifies that it was signed by the CA, and verifies that the jar was signed by the key, they know the key is yours and thus the jar must have come from you, since you are the only one who could have signed it with the private key.
Now, if your key were on their computer ahead of time (for instance, inside of a company where the keys are physically placed on the computers when they're being set up), they yes, you absolutely don't need to have the key signed.