I use TLS for securing my client-server TCP communications.
I have a Qt server and Android and iOS clients. For TLS connection I use only server side certificates, so only clients sure that they are connected to the real server, but server doesn't know whether it is a trusted or malicious application. When server and client TLS via TCP sockets are connected, client can register a new user, or log in as an existing user.
Registration looks like this:
- The user provides login, password and additional information about user(age, location etc.) to the client application.
- The password is hashed using this scheme:
hashed_password = hash(salt + hash(password)), where
salt- one of the user's data field.
- Client sends login, hashed password and additional user's information on the server with registration request.
- Server performs some routine operations(check if this user already exists, are the types of fields correct?) and then registers a new user in the DB: inserts login, hashed on the client side password and additional information about user in the
Log in looks like this:
- The user provides login and password.
- Password is hashed using same scheme:
hashed_password = hash(salt + hash(password)).
- Client sends login and hashed password on the server with authorization request.
- Server checks the
userstable in the DB - is there an appropriate pair of login and hashed password? If yes, server authorizes socket of that client as a some user, now all requests from this socket are interpreted as requests from the identified user, until the socket is closed. But the server hasn't got any "token" and/or some other things(and I know that this is not so good, please check this question),
- Server sends id of the user to the client(of course this id will be used only for self-identification of the client in the future).
All what I can say about messages and other requests is that they are passed without any additional protection, except for TLS.
So, I have simple question: should I use some additional cryptographic protocols, algorithms or another things in order to protect user authentication process and message passing process?