I would like to know your opinion about the following:
I´m developing an Android messenger, where all communication goes from the app -> php -> mysql, from where it will pulled by the receiver in opposite order. So I´ve been thinking about how to make it secure, and thought about the following:
First time the app is installed, a key is generated by the server, and sent to the user. The key is then used to encrypt (maybe with AES256) the next communication to the server. Then in the next communication FROM the server, a new key is received in the package encrypted by the previous key, and this way every message is encrypted by a new key. Then if you´re sniffing packets, you need to have been there the first time the app was installed to have a chance of breaking the security. On the PHP side, I have several scripts, but I´m considering to have one "entrance" script, that receives an identifier of which of the other scripts that communication is ment for, but not the real name of the other script to be addressed. This way hackers won´t know the name of any of the scripts except for the "entrance" script. I´ve already set up all code in the PHP scripts with PDO/prepared statements. I read somewhere that mysql databases are encrypted by default. Is there any reason that I should take further steps to secure the data in the mysql database?