2

What tools or information is needed to verify the authenticity of a SMS message... or to send one so that such authenticity is intact?

This answer describes something as a "message center", but I'm looking for a more complete description of the tools, processes, and possibly the agreements I need to set up with a telco to achieve this.

The main scenarios I'm interested include business to consumer, and consumer to business.

  • 1
    The general answer for this is to use public key cryptography, and sign the messages. The telco infrastructure isn't really designed for his purpose, and would be subject to change without notice. – Steve Sether Sep 25 '15 at 16:18
2

Depends who you are protecting yourself against. In the most paranoid sense, SMSs are transmitted over an insecure channel (your customer's service provider is a MITM). This means that you can't send in any special way to authenticate your SMSs.

Therefore, any true authentication has to be within the SMS itself - for example, a signature (by ECC/HMAC/etc.). This signature will not be directly useful to humans, so you'd need special software on the receiver's device to verify the signature - and once you've got that software, you might as well consider sending the message over the internet instead.

0

I cant really speak for the listed scenarios you mention here so maybe this is better served as a comment.

TextSecure can handle this using standard public key cryptography methods assuming both users have it. You need to share/verify the key through an out of band method, but from then on you have a good idea of the integrity of the messages. It used to work over SMS but I haven't used it in a while so the new versions might operate over the internet instead. However it goes full crypto rather than just signing the message which might not be what you are looking for.

Link anyway: https://play.google.com/store/apps/details?id=org.thoughtcrime.securesms

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.