I am designing a software architecture and i need some suggestion and clarification on few issues.
This will be a server side RESTfull API for accessing data and multiple mobile/desktop client to access to API, collect some data and digital goods to consume in clients. It will be accessed over HTTPS
Server side applications programming language will be C# on .Net Framework 4.6 and it will run on Azure
Clients can be run on a Computer (MAC, PC, Linux), Browser, Smart phone or Tablet (iOS, Android, Windows Phone, Windows Store)
Clients will authenticate to REST service by using oAuth 2, then member will authenticate by using its username and password. Member Unique Id will be stored in client database to authenticate and request to API for the further steps/request since there will be no login required if member logs-out intentionally.
When member request from API there will be a download process for medium size digital files (like pdf or video files about 200 mb). Files will be encrypted on the server to decrypt on the client while it is consuming. That means we will decrypt digital products on runtime, so no file will be stored in the client decrypted. So my decryption must be very fast and low resource consuming but secure.
Members will be allowed to register -let’s say- 3 devices to use client software
Client devices will be registered automatically when member first use the app on the device.
Files needs to be consumed in the client if the client is registered, member is valid and digital product is bought by member. No other member or any other software will not be able to consume products.
Here is my initial approach to implement above requirements in the software so i can secure products and the system:
I could not managed to enter all my explanations in here because form was saying this is a spam. that is why i have add a link below so you can find all my notes in there
Here my questions;
- I will keep my members password in database with SHA-512 hash. I will use SALT for password. So i will keep SALT keys in database for each member. Is it safe and ok to implement that way?
- Should i keep IV (Initialization Vector) in the database for each product so i can use it for encryption? If so i need to expose it via my API so client can obtain it to decrypt. Is it safe to expose?
- Which encryption and Hashing algorithm is best to use in different environment without any problem. I will decrypt files in iOS, Android, Windows Phone, Windows, Mac etc. All native I know it from a friend that he used AES-128 and MD5 on server to encrypt but he face lots of problem on different clients when tried to decrypt files.
- I am planning to use AES-256 (Cipher Mode: CBC, Padding Mode: PKCS7, with IV) and SHA-512. Any comment on this choices?
- I will store 2 different Validation Password and 2 different Encryption password in database so i can use it with AES and SHA-512. But i need to store same passwords in the client code as hardcoded text so i can decrypt product. But this password can be stolen by de-obfuscating it. What is the best way keep this 4 password in the client environment as well as other important client information?
- When i publish iOS, Android and Windows Phone, Windows Store, Mac apps to the markets then they are getting obfuscated and signed automatically. I will manually sign and obfuscate my Windows Application. Is it enough to protect my code against curious people?
- I am using some data to encrypt or hash files or information. I have to expose that data over API so my clients can obtain it and use them for decryption. Is it safe to do it? Is there any other way to do it?
- Any suggestion on the architecture i explain above? Do you predict any kind of vulnerability on the approach?
PS: I can give more details if we need to clarify anything.