1

I have a certificate, with weak ciphers disable, following OWASP recommendations. My framework handles private data that can not be exposed. Is it enough to use TLS to secure the channel? Or should I use something besides TLS, like end-to-end encryption (e.g, use AEAD)?

marked as duplicate by Steffen Ullrich tls Oct 3 '17 at 16:55

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • It highly depends on the 'speed' expectations from the channel; if security is far more important than the speed, you first should try it (more secure one) in development environment, then apply it to the channel. – JackSparrow Oct 3 '17 at 16:39
  • I'm assuming since you suggest end-to-end encryption that your application doesn't need to access the decrypted private data? It's not really clear to me from the question. I'm also not sure why you're equating AEAD with end-to-end encryption. – AndrolGenhald Oct 3 '17 at 16:50