Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am working on creating an android mobile application which needs to connect to a server from time to time. The application makes use of sensitive data which I would not like to get into the wrong hands.

So far I have been able to come up with a model to protect sensitive data both on device and server. However I am still vulnerable to man in the middle attacks.

I have done some reading and searching on my own and found I can either encrypt the data during transport using AES public key infrastructure or I can use an SSL certificate. Obviously SSL would be the better was to go but then again am concerned about the computation overhead it will require.

Further digging around led me to find RCF-SSL which is fast and convenient as Google implements this system but a simple search reveals that RCF encrypted data can easily be de-crypted by dedicated hackers.

What would be the preferred method of transport security and why? If it's SSL, which encryption strategy is secure, fast, doesn't require computation overhead and is preferably recognized by most browsers?

share|improve this question

migrated from crypto.stackexchange.com Jul 3 '13 at 21:17

This question came from our site for software developers, mathematicians and others interested in cryptography.

    
Do you need to register new users as you go or does your server already know them? Also take a look at this answer –  rath Jul 3 '13 at 7:46
    
I need to create new users from time to time plus i have existing users –  Princeobi007 Jul 3 '13 at 7:48
3  
There is no such thing as an "AES public key infrastructure". –  Paŭlo Ebermann Jul 3 '13 at 19:27
    
As Paŭlo Ebermann said, there is no such thing as "AES public key infrastructure" also, AES can be part of the SSL protocol, and SSL is encryption, so your title is meaningless. I think you don't have nearly enough knowledge of crypto to think you can do better than the platform's included SSL/TLS system. Also, unless your Android devices are REALLY OLD and you are transferring a LOT of data it is unlikely that you will notice any overhead at all using SSL/TLS, so why go to the trouble to try to implement something else? –  Rod MacPherson Jul 4 '13 at 1:59

3 Answers 3

Using Android's DefaultHttpClient you can establish an HTTPS connection and configure it to trust only certain certificates. It's quite easy to use and it's already there. You can even use SSLSocket if you don't fancy HTTP. The main point is: don't do your own crypto.

As for the overhead, don't worry, most of the time it's negligible. Your data is sensitive and the communication will happen from time to time. As far as I can see, there's nothing against using SSL here.

share|improve this answer

The best solution for transport security is TLS/SSL. It's supported by default and the overhead is minimal. It support implicit authentication as well.

If you want users to ONLY trust your servers, then you can create your own CA certificate which you distribute with your app, and which you instruct your app to use as its only trust root. Then you can sign your own server certs with that custom CA cert. You can likewise do client authentication by signing a client certificates with the same CA which you can distribute to app users using whatever strategy you choose.

As mentioned elsewhere, just use the utilities provided by the platform. If you're thinking about specific encryption protocols then you're almost certainly doing it wrong.

share|improve this answer

Bottom line use SSL and educate your users. If you want maximum protection use Extended Validation but you pay a premium for that. SSL can still be susceptible to a man in the middle attack if the user clicks through the warning. Modern browsers do a little better job of scaring people into not accepting an invalid certificate but a lot of times they will still just click through. Make sure you educate your users. Show them what a bad cert looks like and to under no circumstances accept it.

If the data is so sensitive and you don't want to risk it make the users VPN into the network before they can access the site and still use SSL just in case.

share|improve this answer
    
EV doesn't give any advantage for custom clients which only connect to their author's servers. The only point in EV certs is displaying a verified company name in browsers with a nice green background. –  CodesInChaos Jul 4 '13 at 6:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.