私钥和公钥

Question

When I create a user I will create a private and public key. The public key is the token id for the user. The private key will be used for encrypt and decrypt of data.

When the user login, my Android app will call a REST Web Service and after validation will return the private and public key. Then using private key the app can create a signature.

Is this a correct way? I am just using HTTP not https.

Answer 1

Is this a correct way?

No.

I am just using HTTP not https.

Why? I can't see why you don't just use HTTPS like everybody else. It's a solved problem.

To correct your mis-statements:

1. The private key is used to decrypt data only, and create digital signatures.
2. The public key is used to encrypt data and verify digital signatures.
3. The public key is of no use as a user token, because it is, err, public.

You need to learn a lot more about PKI than you presently appear to know.

Answer 2

The short answer: No

First you are transmitting an private key over unprotected HTTP.

Second it is totally unclear what you want to achieve using a public/private key. From your description I read that you want to use it for authentication and signature. But why is the private key stored on the server?

usually it is the other way around: The client has public and private key. It sends the public key to anybody who wants but th private key NEVER LEAVES THE DEVICE !