There are mobile banking applications that use SMS channel to communicate with their server. Some of them offer both internet and sms channels which the customer gets to choose from.
While there's much data on secure communication via internet (How to implement TLS, certificate pinning, etc) by OWASP, Enisa, Gartner and other organizations there seems to be lack of guides and tutorials on how to have data transmitted securely over SMS channel.
Several options come to my mind about secure architecture for SMS data transmission:
PGP like system where server's public key is bundled with the application and resides on customers phones. The application uses this key and a symmetric key to encrypt its data.
HTTPS like system where each time the client and the server communicate, they agree on a session key and the data is encrypted using that.
Other solutions where symmetric key is stored or generated on the client side and no public key cryptography is used are generally insecure.
SMS has a limited length so one of our goals in this system has to be keeping the messages as short as possible, what are some ways we can achieve this goal without losing the security of the system. (Does it make the first proposed option (PGP like) more suitable?)
In this scenario the data is encrypted both by the server and the clients, integrity is our concern here too and we want to keep the number/length of transmitted messages as short as possible to minimize round trip time and number of text messages sent.