I'm working on a chat server for a mobile app I am writing. I would like to use a different application server for non-chat related operations and another application for chat operations.
I would like to encrypt the user's id, the user's username, and the name of the chat stream and pass those to the client—and store that in a key on the client (call it ChatKey). From there, the client sends the ChatKey and their message to the chat application server. The client also can fetch messages from the specified stream with the ChatKey. This communication is done over HTTPS.
Why encryption at all? I don't want the user to be able to spoof their username, their id, or the chat stream when communicating with the chat application server. But I also would like to reduce overhead: I do not want the main application server to have to broker communications with the chat server.
I am wondering:
1) does this implementation make sense? 2) is symmetric cryptography okay? 3) which package is good to use? there are so many out there and I am lost! In particular I am interested in packages in Go and Python (RSA? ECDSA?)
The private key would only reside on the main application server and the chat application server.