Perhaps I'm being overly paranoid, but after reading recent news regarding network security I'm starting to believe that SSL isn't quite enough anymore for sensitive data transmissions.
I'm a web developer looking into building some new APIs, mainly for private use (company machines talking to each other). Some systems could be outside the corporate network. My question is surrounding additional security pertaining to APIs themselves.
Has anyone ever thought about or has implemented something like PGP or AES to actually encrypt all the data going back and forth inside API communications?
I'm talking about still using SSL as the blanket wrapper on the outside but then going a step further by encrypting the entire payloads. Obviously this creates some steep overhead in encrypting/decrypting on both ends. The thing is, I'm OK with this conceptually. Hardware is cheap.
What I'm not particularly fond of is just sending my data in clear text and putting all my eggs in the SSL basket anymore.