Java Securing network traffic

Question

First of all, I have googled how to secure network traffic and I have found a lot of answers... Only the issue is that I've found too many examples and methods and the majority of the them are very old (> 10 years), so it worries me a little bit.

What I want to know is how I could encrypt network traffic between a server and a client.

I have had a bachelor degree class about it and from what I understand, I need a private-public key pair to encrypt and decrypt. However I may have missed some important notion, because I've got this question currently about that: How can I send the key over the network when that key is the key with which you need to secure the network? Do I even have to deal with it, or are there built-in applications of secure networking in Java?

What I also have seen in class was that the instructors needed to manually verify some key codes to be 100% sure that some person was sending a message (manually as in looking at someone else's screen and comparing the keys to see if they were indeed the same).

I am using sockets currently, and I am not even sure if networking can even be done differently in Java. I would like to know how I could achieve secure networking.

Any links to relevant material are appreciated, preferably I want to know the best solution if there happens to be any. If the link/article is dated, then please justify that it can still be used after 5 or 10 years.

Regards.

Answer 1

Use Transport Layer Security (eg the OpenSSL library).

If you want to roll your own security, then use AES to encrypt the data; Java has built-in support or AES, or else you can use the Bouncycastle library. Then use RSA to encrypt the AES key, and send the encrypted key and the AES-encrypted data from the server to the client; the client decrypts the key, then uses the key to decrypt the AES-encrypted data.

Java AES Tutorial , Java RSA Tutorial