Re: Digital Signature for MIDlet?

I agree with Joe on both accounts:

On phones where you can't use HTTPS without being signed, you're also
likely to have trouble installing a signed MIDlet as the cause may be a
lack of root certificates on the phone rather than a permissions
restriction.

We've used BouncyCastle in the past and I'd recommend using that as a
backup when HTTPS fails, allowing you to encrypt all data or just the
most sensitive. I think it added about 16Kb to the JAR in our case.

Cheers,
Kirwan


Joe Bowbeer wrote:
> On 7/24/07, foo shyn <[email protected]> wrote:
>> Thanx for the link. The project would be running in Malaysia and the
>> targeted carriers would be the 3 main telcos in our country.
>> The application would connect through HTTP connection to back end
>> servers to perform transaction / data transfer, and we are thinking of
>> getting it done through HTTPS, which is why i'm looking at SSL.
>>
>> However, Motorola does not support digital signature for MIDlets?
>>
>
> If you need a secure connection your MIDlet can use HTTPS without
> needing to be signed.  (Signing is usually used to bypass annoying
> permission checks, and to enable access to restricted interfaces.)
>
> You can also "roll your own" secure connection using, say, the
> bouncycastle crypto libraries, but it doesn't sound like you need to
> do this.

===========================================================================
To unsubscribe, send email to [email protected] and include in the body
of the message "signoff KVM-INTEREST".  For general help, send email to
[email protected] and include in the body of the message "help".