2
$\begingroup$

I am working on encryption/decryption for the rest of the API. The client here can be mobile, desktop, web browsers, etc and all the requests will be made to an https endpoint.

The main goal here is that the encryption/decryption has to be performed in client-side applications. The user himself should not be able to monitor the request/response made from his device(phone, browser, etc) and be able to perform encryption/decryption by himself. He should not be able to see the request/response in cleartext. Everything should happen in the client-side application.

For every request it should follow the steps as follows :

  • Client application encrypts the request data and makes an API call
  • Server decrypts the data and performs operations
  • Before sending the response back to the client application, the server encrypts the response and sends it
  • Client application decrypts the response and uses it

I had planned to use AES-256 but faced the following problems :

  • Secret key has to be stored hardcoded in the client-side applications. Doing so won't be safe
  • Getting the secret key every time from a rest API is not safe either as the request can be monitored and the key can be fetched from the response

I had planned to use AWS KMS service but faced the following problems :

  • For every encryption/decryption to be performed the client side has to login to AWS and then use the KMS service
  • If the login request is made then the request can be monitored again and the access key and secret key can be fetched from the response/request and then once the login access is gained, anyone can use the KMS service to encrypt/decrypt data

I did check articles where the secret key should be separate for each user and should be based on password but in my case User can log into to client-side application as a guest user so there won't be any password, email that has to be provided.

Not very sure how separate keys can be used for each user as the encryption/decryption has to be performed every time on both the client and server-side.

AES-256 is considered to be safe but I still didn't find any ways on how can a private key be managed on the client-side. Any help here on how can AES, KMS be used? Any other solutions would be fine too.

Improve this question
$\endgroup$
4
  • $\begingroup$ There are securing key mechanism in Android that is key store and IOS enclave. Did you look at those? $\endgroup$
    – kelalaka
    Sep 4, 2020 at 11:43
  • $\begingroup$ I did look into articles for that but if my application is for browser(a website, a browser game) then it will be either windows, mac , ubuntu and so on. So I was looking for a generalized solution and didn't go too deep into it $\endgroup$
    – Deekshith Hegde
    Sep 4, 2020 at 11:46
  • $\begingroup$ Keystore are generic. They can be used in any of the platform. What I am unable to understand is what are you trying to secure. Can you tell me what kind of sensitive information is in the request which should be protected from the user. $\endgroup$
    – AjayLohani
    Sep 5, 2020 at 16:36
  • $\begingroup$ @AjayLohani In case of keystore, if the logic for creating key is in client side, then user can know it. Also if it is sent in response(from server) it can be known as well. The reason I am trying to hide request data from user is to avoid user knowing what data is been sent in which requests and also there are cases where the user can make a same request with modified values(eg: score, points in game). In this case the values can be manipulated $\endgroup$
    – Deekshith Hegde
    Sep 7, 2020 at 15:46

1 Answer 1

Reset to default
1
$\begingroup$

In case you want to use AWS KMS without the raised issues, you can use AnonyFlow API for encryption/decryption. it is using the AWS KMS in the background and manage the private keys for you in order to avoid the keys issues you have raised, therefore you enjoy the service without worries.

It's very easy to consume the api, you can use the anony-value for encrypting one or more string values (string array) or use the anony-packet for encrypting json data - you can even define specific keys in order not to encrypt the entire json.

the best practice would be to consume it in your server side code. you can even create a serverless service on aws or any other platform to handle it.

Disclosure: I'm part of AnonyFlow creators.

Improve this answer
$\endgroup$
1
  • $\begingroup$ Could you indicate how the issues that are raised are avoided? Without that, this doesn't really constitute an answer even if the solution of using AnonyFlow solves the problem; just "it is using the AWS KMS in the background and manage the private keys for you in order to avoid the keys issues you have raised" is not enough. $\endgroup$
    – Maarten Bodewes ♦
    Jul 29, 2021 at 7:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.