PKCE与RSA双向
服务器和客户端生成的公共和私钥是否可以实现PKCE？值得吗？ 我认为这是这样的流程：
- 客户端生成私人和公共密钥
- 客户端将公共密钥发送到服务器
- 服务器生成私人和公共密钥，生成随机秘密并使用客户端的私有密钥
- 服务器加密秘密，将秘密发送回到客户端加密的秘密和服务器公共密钥
- 客户端秘密秘密借助他的秘密密钥，使用服务器公共密钥再次对其进行了加密，并将加密的秘密发送回服务器
- 服务器用他的私钥解密秘密并检查是否生成，现在解密的秘密是一样的，
我缺少某些东西吗？这是不好的方法吗？这是加密/解密/生成重量计算的密钥吗？
Can PKCE be implemented with both server and client generating public and private keys? Is it worth it?
What I think is this flow:
- Client generates private and public key
- Client sends public key to server
- Server generates private and public key, generates random secret and encrypts secret with clients public key
- Server sends back to client encrypted secret and servers public key
- Client decrypts secret with his secret key, encrypts it again with servers public key and sends encrypted secret back to server
- Server decrypts secret with his private key and check if generated and now decrypted secret are the same
Am I missing something? Is this bad approach? Is this encryprtion/decryption/generating keys heavy to compute?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您的算法似乎与PKCE标准一样安全。我认为加密随机字符串没有任何其他价值。您还向服务器添加了一个往返，就像在PKCE中一样，生成初始随机字符串的客户端。
加密消耗资源，很容易实施错误。您还需要支持服务器和客户端上的加密算法。因此，我认为尝试将加密添加到一个经过验证的标准中是多余的。
Your algorithm seems to be as secure as the PKCE standard. I don't think there's any additional value in encrypting the random strings. You also add one roundtrip to the server, as in PKCE it is the client who generates the initial random string.
Encrypting consumes resources and it's simple to implement it wrong. You also need support for encryption algorithms on both the server and the client side. Thus, I think it's just redundant to try to add that encryption to a proven standard.