Originally asked on https://crypto.stackexchange.com/questions/24430/security-at-application-layer but was suggested to ask here instead.
I saw lots of questions asking about encryption over http, such as this. Most of the responses I saw said there is no way to verify server's identity so vulnerable to MitM attack.
My question below will be slightly different, because it is asking about mobile environment, where I assume the app is downloaded from AppStore or PlayStore. In this way, I can assume the code is verified and not modified by hacker and the public key of server bundled with the app is not modified either so that it can verify server's identity.
Given these guarantees, is it possible to do encryption at application layer and is there any existing libraries to do it?
More specifically, I am writing some app that talks to HTTP server. The server is hosted on some cheap plans where no HTTPS is available. Assuming the server handles HTTP requests using PHP or Python, is it possible to implement the client and server, so that they do some handshake at the beginning of the session over HTTP, to agree on some encryption keys; afterwards, all messages are encrypted using the keys. So from hackers point of view, they see the HTTP traffic between client and server and they see some basic fields in HTTP headers, e.g. host and endpoint, as plaintext but everything else are just encrypted as HTTP body or some URL argument.
Is that possible and is there any libraries doing that easily? Intuitively speaking, it is just implementing TLS in the application level, so theoretically it is totally possible and has the same security strength as TLS. Do I miss any security holes here?