0

Im developing a system which a android client send and receive data from a mysql database (connected to a java restfull webservice).

To do the authentication method, i dont want to send id&pass in clean text in the URL. Maybe hash and cryptography methods are apropriate, with CHAP or one time pad to avoid replay attacks. But im not sure if this is enough.

Maybe use cryptographic tokens its a better way. But im new with this concept. Any other sugestions or good tutorial for this case?

2

The best way - as it mostly the case - is to use TLS. Then you can simply log in using username/password. Besides authentication, you probably also want to protect the requests and responses. It's not often that you just have to protect against eavesdropping alone, in most of the cases active attacks are also possible (e.g. when using insecure WiFi connections).

You could also have a look at the SRP protocol, but that might be more tricky if you aren't that well informed about cryptography. Besides that, it doesn't provide a complete solution.

2
  • Should i use TLS + end-to-end encryption? I mean TLS covers the channel for communication, but should i encrypt data with RSA when data enters and go out the channel?
    – rew1nd
    Oct 3 '17 at 16:28
  • Yes, if you want to protect the data outside the channel, sure, you can use RSA encryption. Note that you would indeed still need TLS because otherwise it would be next to impossible to trust the public key required to encrypt the data. Note that RSA encryption does not protect against modification / replacement of the data. Oct 3 '17 at 16:38
0

Public-Private key(RSA Algorithm) combination can be considered for first time communication. The public key to be transferred from Java App(Rest service/ API) to Mobile app. Mobile Device now has to pass uid/pwd encrypted by the public key. Once the request reaches Java App/API, by using private key, API will decrypt the date and validate. On successful validation, API will generate unique encryption key(SHA-256 is a good option) and send back to device. Further all the communication will be encrypted and decrypted by using this encryption key.

5
  • That was my first idea. But then after some research, a lot of topics related to crypto tokens, and oauth appear. Nowadays, isnt a more reliable and secure way to use, for example, oauth?
    – rew1nd
    Feb 17 '17 at 14:46
  • @rew1nd, Spring Oauth - Thumps up. Being used by me.
    – rKs
    Feb 21 '17 at 15:12
  • Try to elucidate me. The authenticate server is my rest server, or i will use other api?
    – rew1nd
    Mar 3 '17 at 15:08
  • Yup, Spring Oauth can b wrapped up in REST later in the app server for authentication.
    – rKs
    Mar 5 '17 at 6:28
  • can you provide me the code? @rKs
    – rew1nd
    May 31 '17 at 16:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.