-1

I'm writing some security software, and don't want anyone to be able to intercept data as its passed from client->server, and server->client.

The best way to do this is over HTTPS via SSL. However, I've read that you can't trust HTTPS, as Certificate Authorities can get hacked, or taken over by Governments.

I've also read it's almost always a bad idea, and counter productive to do some sort of Javascript crypto on the data before it's submitted.

So - how do I securely pass data between server and client?

Improve this question
3
  • @archie : $\:$ SRP probably qualifies as "the cryptography required to do so". $\;\;\;\;$
    – Ricky Demer
    Commented Feb 5, 2014 at 1:21
  • 2
    The NSA can probably snoop on you no matter what you do. So just use SSL, understand your risks, and understand that you can't really do anything about it.
    – paj28
    Commented Feb 5, 2014 at 14:23
  • If the client is a browser you're stuck with the default config of SSL. If it's a custom application, you can simply replace the default list of trusted CAs by your own CA. That way you don't need to trust an CAs.
    – CodesInChaos
    Commented Feb 5, 2014 at 14:53

4 Answers 4

Reset to default
1

Unless you don't have a protocol boundation (like http for web-browsing or similar).

I'll suggest you to use ZeroMQ libraries to utilize socket communication with encryption enabled. It'll not only secure your transfer but boost up the speed using it's communication pattern intelligently for your requirement.

There is an article from Pieter (creator of ZeroMQ) about using CurveCP, a high-speed high-security elliptic-curve cryptography to protect communication over ZeroMQ socket transaction.

Improve this answer
2
  • 1
    I wouldn't use ZeroMQ+CurveCP yet, unless you have the skills to do a code review yourself. The implementation is new and probably hasn't been checked much yet.
    – CodesInChaos
    Commented Feb 5, 2014 at 14:56
  • @CodesInChaos I agree the crypto features in ZeroMQ are relatively new, but that's only the application of encryption layer. The encryption scheme are well tested and revised. So, there need to be a careful implementation of the feature with good tests but I think that should be the case with any implementation. And Pieter (the creator/maintainer) is very approachable in case of any issues or confusions tweeted with his mention \@hintjens.
    – AbhishekKr
    Commented Feb 7, 2014 at 7:09
1

You can overcome a lot of that if you have an actual client side application and inspect the certificate used by the server to make sure it matches a known good certificate. You could create your own root certificate, use that to self sign your certificate and then validate that you are the CA in your client. This way, only you are responsible for keeping your private key secure.

Improve this answer
1

You have to make a distinction between SSL/TLS and the x509-based certificate authority infrastructure used in combination with SSL/TLS on the Internet.

While government agencies compromising certificate authorities is definitely a plausible risk, this by no means imply that SSL/TLS is broken. If you control both the client and the server, it is very easy to setup your own certificate authority, generate and sign certificates yourself. Be sure to use a cipher suite that allows for perfect forward secrecy.

Improve this answer
0

Terry is right. TLS is (IMHO) the most effective technology which exists for securing communications across the internet. It does not require use of the existing trust framework. Even if you are only considering the trust framework as the issue you need to address here and were happy to stick with TLS - we don't have nearly enough information about how your application works, how its distributed, configured, installed, maintained and used to make any recommendation as to how you should go about solving your problems.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .