something about SSL?

java-programmer, something about SSL? HI
I am not quite understand SSL, but as i see so far, i need to put
the two identical keystore files belong to server and client program.
If somebody get that keystore file (which is very possible, because
i just embed all my class files in a jar), he may able to write a
client program to connect to my java server and do some hacking things.
Why don't we just encrpt the transfer data by a key and that key is
stay inside in both server/client code. I think it is much more
security than SSLsocket because 1) no keystore file 2) no one is able
to de-compile your class file and take your key(which stay in your
code).

Am i correct? If no, any better security solution for my server/client
software?

thanks
from Peter (email***@***.com)

java-programmer >> something about SSL? email***@***.com wrote:

> I am not quite understand SSL, but as i see so far, i need to put
> the two identical keystore files belong to server and client program.

No. The server has a keystore which contains a public/private key pair.
This is used to identify the server. The client has a 'truststore' which
contains trusted certificates including the certificate of whoever
signed the server's public/private key pair, or whoever signed the
signer .... These things are not the same.

> If somebody get that keystore file (which is very possible, because
> i just embed all my class files in a jar), he may able to write a
> client program to connect to my java server and do some hacking things.

You shouldn't distribute the server keystore.

> Why don't we just encrpt the transfer data by a key and that key is
> stay inside in both server/client code.

The key used to encrypt SSL traffic is no static, it is negotiated
during the SSL handshake and expires regularly. This is all extremely
secure, and certainly much more secure than what you suggest.

> I think it is much more
> security than SSLsocket because 1) no keystore file 2) no one is able
> to de-compile your class file and take your key(which stay in your
> code).

No.

> Am i correct?

No.

> If no, any better security solution for my server/client
> software?

TLS/SSL as implemented in JSSE is several times as strong as generally
required.