Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

I'm writing some security software, and don't want anyone to be able to intercept data as its passed from client->server, and server->client.

The best way to do this is over HTTPS via SSL. However, I've read that you can't trust HTTPS, as Certificate Authorities can get hacked, or taken over by Governments.

I've also read it's almost always a bad idea, and counter productive to do some sort of Javascript crypto on the data before it's submitted.

So - how do I securely pass data between server and client?

share|improve this question

marked as duplicate by symcbean, TildalWave, Adi, Xander, Steve Feb 6 '14 at 16:00

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

@archie : $\:$ SRP probably qualifies as "the cryptography required to do so". $\;\;\;\;$ – Ricky Demer Feb 5 '14 at 1:21
The NSA can probably snoop on you no matter what you do. So just use SSL, understand your risks, and understand that you can't really do anything about it. – paj28 Feb 5 '14 at 14:23
If the client is a browser you're stuck with the default config of SSL. If it's a custom application, you can simply replace the default list of trusted CAs by your own CA. That way you don't need to trust an CAs. – CodesInChaos Feb 5 '14 at 14:53

Unless you don't have a protocol boundation (like http for web-browsing or similar).

I'll suggest you to use ZeroMQ libraries to utilize socket communication with encryption enabled. It'll not only secure your transfer but boost up the speed using it's communication pattern intelligently for your requirement.

There is an article from Pieter (creator of ZeroMQ) about using CurveCP, a high-speed high-security elliptic-curve cryptography to protect communication over ZeroMQ socket transaction.

share|improve this answer
I wouldn't use ZeroMQ+CurveCP yet, unless you have the skills to do a code review yourself. The implementation is new and probably hasn't been checked much yet. – CodesInChaos Feb 5 '14 at 14:56
@CodesInChaos I agree the crypto features in ZeroMQ are relatively new, but that's only the application of encryption layer. The encryption scheme are well tested and revised. So, there need to be a careful implementation of the feature with good tests but I think that should be the case with any implementation. And Pieter (the creator/maintainer) is very approachable in case of any issues or confusions tweeted with his mention \@hintjens. – AbhishekKr Feb 7 '14 at 7:09

You can overcome a lot of that if you have an actual client side application and inspect the certificate used by the server to make sure it matches a known good certificate. You could create your own root certificate, use that to self sign your certificate and then validate that you are the CA in your client. This way, only you are responsible for keeping your private key secure.

share|improve this answer

You have to make a distinction between SSL/TLS and the x509-based certificate authority infrastructure used in combination with SSL/TLS on the Internet.

While government agencies compromising certificate authorities is definitely a plausible risk, this by no means imply that SSL/TLS is broken. If you control both the client and the server, it is very easy to setup your own certificate authority, generate and sign certificates yourself. Be sure to use a cipher suite that allows for perfect forward secrecy.

share|improve this answer

Terry is right. TLS is (IMHO) the most effective technology which exists for securing communications across the internet. It does not require use of the existing trust framework. Even if you are only considering the trust framework as the issue you need to address here and were happy to stick with TLS - we don't have nearly enough information about how your application works, how its distributed, configured, installed, maintained and used to make any recommendation as to how you should go about solving your problems.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.