I have an SDK for my web app, which user can integrate into his android app. For authentication, we have an authkey. And it is sent as a POST or GET parameter when server-to-server communication occurs. But in the app, I fear someone can just get the authkey by any method, while transmission. For that I thought of encrypting the authkey, but still, it will always be the same encrypted authkey and someone can just get ecnrypted authkey and can use the same to send data.
For avoiding this, I came with a logic, which I think is secure enough to send authkey with encryption and sending different encrypted authkey each time. Here is the process.
- I have a authkey, lets say ABCD1234, which I need to send
- I generate a cryptographically secure random number, lets call it rand_number
- I then encrypt my authkey with this rand_number, using 'aes-256-cbc', and call it as auth_token
- I then encrypt the rand_number with my public key, and call it as time_token.
- I then transmit this auth_token and time_token to my server
And server side:
- I will decrypt time_token with my private key, and get rand_number
- Will decrypt auth_token with this rand_number, and get the authkey.
Is this method secure enough ? Even if we disclose the whole process of encryption and sending data?
I don't know, but I have a feeling that, this would be an already exisiting method.