I am working on creating an android mobile application which needs to connect to a server from time to time. The application makes use of sensitive data which I would not like to get into the wrong hands.
So far I have been able to come up with a model to protect sensitive data both on device and server. However I am still vulnerable to man in the middle attacks.
I have done some reading and searching on my own and found I can either encrypt the data during transport using AES public key infrastructure or I can use an SSL certificate. Obviously SSL would be the better was to go but then again am concerned about the computation overhead it will require.
Further digging around led me to find RCF-SSL which is fast and convenient as Google implements this system but a simple search reveals that RCF encrypted data can easily be de-crypted by dedicated hackers.
What would be the preferred method of transport security and why? If it's SSL, which encryption strategy is secure, fast, doesn't require computation overhead and is preferably recognized by most browsers?