SSL vs Encryption

Question

I am working on creating an android mobile application which needs to connect to a server from time to time. The application makes use of sensitive data which I would not like to get into the wrong hands.

So far I have been able to come up with a model to protect sensitive data both on device and server. However I am still vulnerable to man in the middle attacks.

I have done some reading and searching on my own and found I can either encrypt the data during transport using AES public key infrastructure or I can use an SSL certificate. Obviously SSL would be the better was to go but then again am concerned about the computation overhead it will require.

Further digging around led me to find RCF-SSL which is fast and convenient as Google implements this system but a simple search reveals that RCF encrypted data can easily be de-crypted by dedicated hackers.

What would be the preferred method of transport security and why? If it's SSL, which encryption strategy is secure, fast, doesn't require computation overhead and is preferably recognized by most browsers?

Answer 1

Using Android's DefaultHttpClient you can establish an HTTPS connection and configure it to trust only certain certificates. It's quite easy to use and it's already there. You can even use SSLSocket if you don't fancy HTTP. The main point is: don't do your own crypto.

As for the overhead, don't worry, most of the time it's negligible. Your data is sensitive and the communication will happen from time to time. As far as I can see, there's nothing against using SSL here.

Answer 2

The best solution for transport security is TLS/SSL. It's supported by default and the overhead is minimal. It support implicit authentication as well.

If you want users to ONLY trust your servers, then you can create your own CA certificate which you distribute with your app, and which you instruct your app to use as its only trust root. Then you can sign your own server certs with that custom CA cert. You can likewise do client authentication by signing a client certificates with the same CA which you can distribute to app users using whatever strategy you choose.

As mentioned elsewhere, just use the utilities provided by the platform. If you're thinking about specific encryption protocols then you're almost certainly doing it wrong.

Answer 3

Bottom line use SSL and educate your users. If you want maximum protection use Extended Validation but you pay a premium for that. SSL can still be susceptible to a man in the middle attack if the user clicks through the warning. Modern browsers do a little better job of scaring people into not accepting an invalid certificate but a lot of times they will still just click through. Make sure you educate your users. Show them what a bad cert looks like and to under no circumstances accept it.

If the data is so sensitive and you don't want to risk it make the users VPN into the network before they can access the site and still use SSL just in case.