Question

I am looking to see if there is a possibility to generate two same alpha-numeric strings in two different java codes. This is for the purpose of secured communication between client and server.

Or is there an alternative way to do this?

I looked at the usual ways of public private key encryption and related stuff. For my requirement, I do not need such a mechanism as its kind of too much of standard stuff. I am kind of looking for a simple alternative like this.

Thanks,
Abishek

Answer 1

I think what you’re looking for is akin to a time-synchronized one-time password.

A simplistic way to do this is to use the system time, rounded to the nearest, say, 6-second ‘pulse’ as a seed for a cryptographically secure random number generator (Java provides SecureRandom FWIW). Then, along with a pre-shared ‘secret’ put that through a one-way cryptographic hash (say, SHA256) to generate your alpha-numeric (hex or base64) string.

If you don’t need to display/pass along the actual string, then I suppose you can skip the hash step and just use the shared secret and the synchronized time as the IV + key for a cipher applied to the communications stream on both ends.

The obvious risk or complication with this approach is keeping the two system clocks in sync. If you use NTP or some other time synchronization protocol, then you have to secure that as well (otherwise you’re potentially open to a replay attack). Standard computer clocks are prone to drift (hence the 6-second window) and you have to secure them from tampering as well.

(Disclaimer: I am not a security specialist so don’t think for a moment that what I’ve outlined about is completely secure/safe as is.)