[Qt-interest] QCA big string encryption

[Jeroen De Wachter]

Hi Nicholas,

On Mon, 2011-04-25 at 00:24 +0300, Nicholas Shatokhin wrote:
> I need to encrypt JSON string that contains fingerprint data in Base64 and  
> a Public Key in Base 64 too.

I would suggest you encrypt that data using a symmetric encryption
algorithm. How you determine the symmetric key to be used for that
encryption is entirely up to you. Using an asymmetric encryption
algorithm to negotiate the symmetric key is certainly one of the more
secure options for it.

> Is it safe to encrypt and send a symmetric key? Someone can get access to  
> the application and try to get the key and send data to the server on  
> behalf of the application.

Symmetric keys are typically not used for long. With SSL, for instance,
a new symmetric key is negotiated (secured by an asymmetric encryption
algorithm) for every new connection, if I'm not mistaken.

To hack into a server session while it is going on would be possible
only for very simple symmetric key algorithms (DES might be one of
these), and even then it would be rather difficult. If you use a decent
symmetric algorithm (by current standards, like AES256), it's next to
impossible.

Storing data secured with a symmetric algorithm is somewhat more tricky,
as it might be possible to decrypt it, given enough time.

Kind regards,

Jeroen