I am to implement a system where android devices connect to a central server and have to register with different user accounts, so I have decided to create a pairing dance similar to what can be observed in bluetooth pairing, or software like the apple remote pairing with the itunes library. I'm searching information on what encryption algorithms can be used during this communication using a separate communication channel for the encryption key. The algorithm I've thought of would follow these steps:
- The device powers on and calls a fixed server to announce itself.
- The device shows a few random numbers on the screen (eg. 392582).
- The user has to log in on the server with a web browser into his account and type in the number sequence seen on the device (might be done on the android device itself).
During step 1 the client would communicate to the server through SSL. The number shown to the user in step 2 would be part of a longer static predetermined string which would be hashed. The server and client would exchange the hash and verify it is the same. If it is, it means the pairing is OK. Some questions haunting me:
- Is this actually sound or paring devices is done in other ways?
- Is using MD5 hashing enough for this or should I be using other hashes?
- What length and time expiration should the screen code have in order to prevent collisions with other potential users?
- What refinements can be done to improve the authenticity of the connection? I've though of replacing the static longer predetermined string to hash with a random string. The client would send the seed of the random number generator during the first step. A man in the middle would still get it, but would this reduce hash collisions with other users?
- I lack the technical security jargon, maybe this is a well studied process and tons of wikipedia articles exists on it? The information on wikipedia about bluetooth pairing/bonding doesn't give out too much technical details about implementation. Where should I look?