title: Java JSSE TLS - Is this connection safely encrypted in both directions?
body: <p>In Java using JSSE with TLS. I have created a secure socket between the server and client. After finally getting the sockets to connect securely, I still have a fundamental question about my existing code's security. I followed instructions in a tutorial, and sometimes the documentation in the JavaDoc is very precise but a little vague unless you speak the Swaheli dialect of Jargon....</p>
  
  <p>I have been network programming for quite awhile now in C++. The transition to Java was easy. Recently, however, I have found it prudent to make the traffic secure. This being said:</p>
  
  <p>I want to create a secure socket in the same way a web browser creates a secure socket, so traffic in both direction is encrypted. A client can see their personal account information sent from the server (very bad if intercepted), and a client can send their username and password to the server securely (also very bad if intercepted).</p>
  
  <p>I know all about how public key cryptography works, but there's a side effect to public key cryptography alone. You send your public key to a client, the client encrypts with the public key, and sends data to the server only the server can decrypt. Now from what I understand, the server uses the private key to encrypt messages going to the client, and another layer of security needs to be added to prevent anyone with the public key from being able to decrypt it.</p>
  
  <ol>
  <li>I have a public / private key pair stored in files public.key and private.key (i made these using JSSE's keytool utility</li>
  <li>I included public.key in the client</li>
  <li>I included private.key in the server</li>
  </ol>
  
  <p>Client Class:</p>
  
  <pre><code>    KeyStore keyStore;
      TrustManagerFactory tmf;
      KeyManagerFactory kmf;
      SSLContext sslContext;
      SecureRandom secureRandom = new SecureRandom();
      secureRandom.nextInt();
  
          keyStore = KeyStore.getInstance("JKS");
          keyStore.load(this.getClass().getClassLoader().getResourceAsStream("server.public"),"public".toCharArray());
          tmf = TrustManagerFactory.getInstance("SunX509");
          tmf.init(keyStore);
          kmf = KeyManagerFactory.getInstance("SunX509");
          kmf.init(keyStore, "public".toCharArray());
          sslContext = SSLContext.getInstance("TLS");
          sslContext.init(kmf.getKeyManagers(), tmf.getTrustManagers(), secureRandom);
          SSLSocketFactory sslsocketfactory = sslContext.getSocketFactory();
          SSLSocket sslsocket = (SSLSocket)sslsocketfactory.createSocket("localhost", 9999);
  </code></pre>
  
  <p>Server Class:</p>
  
  <pre><code>    String passphrase = "secret"
      KeyStore keyStore;
      TrustManagerFactory tmf;
      KeyManagerFactory kmf;
      SSLContext sslContext;
      SecureRandom secureRandom = new SecureRandom();
      secureRandom.nextInt();
  
          keyStore = KeyStore.getInstance("JKS");
          keyStore.load(this.getClass().getClassLoader().getResourceAsStream("server.private"),passphrase.toCharArray());
          tmf = TrustManagerFactory.getInstance("SunX509");
          tmf.init(keyStore);
          kmf = KeyManagerFactory.getInstance("SunX509");
          kmf.init(keyStore, passphrase.toCharArray());
          sslContext = SSLContext.getInstance("TLS");
          sslContext.init(kmf.getKeyManagers(), tmf.getTrustManagers(), secureRandom);
          SSLServerSocketFactory sslserversocketfactory = sslContext.getServerSocketFactory();
          SSLServerSocket sslserversocket =
          (SSLServerSocket)sslserversocketfactory.createServerSocket(9999);
  </code></pre>
  
  <p>/ <strong><em>*</em>**<em>*</em>**<em>*</em></strong> THE QUESTION <strong><em>*</em>**<em>*</em>**<em>*</em>*</strong>/</p>
  
  <p>Everything works! I attach the sockets to BufferedReader and BufferedWriter and begin talking beautifully back and forth after accept(); ing the connection from the client and starting my client and server send / receive loops.</p>
  
  <p>Now I know that at this point client to server communication is secure. Only the server key can decrypt traffic coming from the client. But what about server to client communication? The client's key can decrypt messages coming from the server, but in Public Key Crypto 101 you learn that the client is now supposed to send a public key to the server. Is this happening behind the scenes in this code? Did SSLContext take care of this? Or now that I have an encrypted connection from the client to the server, am I now expected to generate a private/public key pair for the client as well?</p>
  
  <p>Let me know if the traffic being sent and received in the above code is actually secure in both directions.</p>