I'm a masters student in computer science who works part time with my own company as a consultant.
My lastest project is based on my bachelor thesis which handles everything except the security. The application will be audited by a much larger company than those who hired me and one requirement in the audit is dual layer of security on all channels.
The first layer will of course be ssl/tls. As for the second one I've come up with the following.
- HTTP Digest Access Authentication - for credential exchange
- DHKE - to create a shared secret that afterwards is used to transport an AES key.
- RSA - to digitally sign the response from the server to ensure that there is no man in the middle.
My first thought was to use RSA to securely transport the key. But I thought that I could reduce the overhead by using DHKE instead. Correct me if I'm wrong.
The protocol would work something like this:
Client-> (username + public information for DHKE) -> Server Server-> (B from DHKE, salt for HTTP digest, AES key encrypted with DHKE secret) -> Client (Whole message signed with server private key) Client-> AES(Hashed information for HTTP digest) -> Server Server-> AES(Session token) -> Client
Once the session is initiated all messages will be encrypted with the AES key. I am probably overthinking this and missing a lot of details and I would greatly appreciate some advice.
Kind regards Johan Risch