Note : I'm posting this for a friend of mine who doesn't speak english very well... Well, I'm not so good myself, so excuse me in advance !
My friend's developing a Smartphone application, and they would like to have some advice to protect the IDs of the database.
The only idea we've got so far consists in :
- All communications are done using asymmetric encryption (private key on the server)
- The credentials are stored, encrypted, client side and the decryption key is stored server-side
When the application would need to use the credentials, it would ask the server for the decryption key.
Would that be secure?
Wouldn't we need to authenticate the client? I guess if we don't, it would be the same as sending the decryption key as plain text.