I'm implementing a mobile app which uses AES encryption algorithm to encrypt some critical values being sent to a remote server (basically, the user password), and then decrypted on the server side using the same private key. This works perfectly now, but I'm a bit concerned about how to store/get the private key.
Currently, I've splitted the private key (which is hardcoded) into 3 string objects, and when needed, I concatenate them. I'm afraid this is not a valid solution, though, as any malicious user could simply decode the binary and with a bit of patience get the three parts.
The questions are:
What would be a good approach which at least would make it difficult to the attacker to know the private key?
Would help using a private key based on an event (for example, the current date) instead of storing it?
:)
– apnorton Mar 10 '14 at 22:13