2

I'm developing a json API that should be able to handle a huge amount of clients. To make this work I need to reduce the overhead as far as possible.

One of the ideas I have is to use https only in the initial registration process of each client to exchange a symmetric key that is generated for each client. This would enable me to use http with symmetric encryption and a minimum overhead. Do you see any downside and security issues in this?

4

What you propose is actually similar to normal https with session reuse, i.e.

  • The initial handshake needs asymmetric encryption to identify the server and (depending on the cipher) to securely create the key for symmetric encryption. The transport encryption then is done with symmetric encryption only.
  • Following handshakes just reuse the existing session and only symmetric encryption is needed.

Thus what you propose exists, is established and I recommend to use it.

Do you see any downside and security issues in this?

I do not see any obvious security issues in design and implementation because the design is not specific enough and there is no implementation yet. But on the technical side I see several issues:

  • I don't know how you implement your encryption, but libraries implementing SSL/TLS are already tuned for speed (often use hardware acceleration). Can you easily top this with your implementation?
  • The SSL/TLS protocol is widely used and heavily analyzed. How about your design?
  • I've never understood why anybody interested in performance uses text based formats like JSON or XML anyway. If you need performance and low overhead use binary formats like protobuf or the old but established ASN.1 encoding.
  • And SSL provides security across the whole communication channel so that a MiTM can't monitor requests as well/easily. And SSL ensures there's no replay of packets. – Neil Smithline Nov 4 '15 at 20:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.