Im developing a system which a android client send and receive data from a mysql database (connected to a java restfull webservice).
To do the authentication method, i dont want to send id&pass in clean text in the URL. Maybe hash and cryptography methods are apropriate, with CHAP or one time pad to avoid replay attacks. But im not sure if this is enough.
Maybe use cryptographic tokens its a better way. But im new with this concept. Any other sugestions or good tutorial for this case?
The best way - as it mostly the case - is to use TLS. Then you can simply log in using username/password. Besides authentication, you probably also want to protect the requests and responses. It's not often that you just have to protect against eavesdropping alone, in most of the cases active attacks are also possible (e.g. when using insecure WiFi connections).
You could also have a look at the SRP protocol, but that might be more tricky if you aren't that well informed about cryptography. Besides that, it doesn't provide a complete solution.
Public-Private key(RSA Algorithm) combination can be considered for first time communication. The public key to be transferred from Java App(Rest service/ API) to Mobile app. Mobile Device now has to pass uid/pwd encrypted by the public key. Once the request reaches Java App/API, by using private key, API will decrypt the date and validate. On successful validation, API will generate unique encryption key(SHA-256 is a good option) and send back to device. Further all the communication will be encrypted and decrypted by using this encryption key.
