[aerogear-dev] Passphrase encryption - REST API discussion

[Bruno Oliveira]

nswers inline.

-- 
abstractj

On March 13, 2014 at 10:29:48 AM, Matthias Wessendorf (matzew at apache.org) wrote:
> On Thu, Mar 13, 2014 at 2:16 PM, Bruno Oliveira wrote:
> 
> > Ahoy, regarding the HTTP header we can move it to the body. What would you
> > suggest?
> >
> 
> No, I'd like to avoid that protected header/body at all :-)
> 
> But... if the server really can not figure out if cert. and its passphrase
> are encrypted, I guess I can live w/ it - for now.
> Ideally the SEND API stays unchanged

We can if we add one step further. Let me put the new idea in a gist (https://gist.github.com/abstractj/55905ed53fce2ca22388). 

If developer requested a key pair, we create a new one for that PushApplicationID and check it on Sender if exists a key pair for that application. Into this way we make encryption totally optional.

Does it make sense?
 
> > >
> > > encrptyed w/ the help of the public-key ?
> >
> > Totally correct
> >
> 
> Ok, good. Oh, question: do we provide a tool for the encryption?

Sure thing, I’m all for make it easy.

> > Correct. But with we agree on the flag, might be necessary to include
> > something like "protected: true" as optional argument. Or any other thing
> > to let the server know.
> >
> 
> yeah, I see. Hrm - not sure I like the flag :-)
> Perhaps there is a way (at least for the "long run") that the server gets:
> Ah, it is encrypted (or not).
> 
> As said the flag is not the end of the world - I just try to make the
> "SEND" as simple as possible :)

If we agree on that gist, we don’t need this flag anymore.

Let me know what do you guys think about the idea.