I am starting a communication test work with a webservice, and this interaction includes encryption protocols AES and RSA. However, the site that has the webservice (followzup) only provides examples in PHP and Java.
How to proceed this test? What protocol should I use first?
Related
I'm working on a project that take the GPS location every 5 seconds and send it to the server, but i need to make a little of security, so i need to encrypt the location in android device and decrypt it in server side, so i'm searching for a simple algorithm to do this
Thanks in advance
The ideas for you to try:
Send your data over HTTPS. It will add the layer of security you need and it's one of the simplest methods available.
Use Java Encryption API with asymmetric cryptographic algorithm like RSA. You should probably avoid using AES or similar symmetric algorithm because you should not store passphrase in your Android app - it could be quite easily compromised.
I am trying to use asymmetric encryption to encrypt firmware. The bootloader will decrypt and update the flash. This is on a embedded device with 32 bit CPU executing at 60MHz.
I want to use ECC due to its varies advantages. I am new to encryption and my understanding os ECC as implemented in ECIES is to use ECC for the key generation and use AES for actual data encryption. Due to code and ram size, I cannot support multiple encryption algorithms.
Is there a implementation of ECC that can be used just like AES. All I am looking for is to use a "Private key" to encrypt firmware and the bootloader uses "Public Key" to decrypt it.
Thanks.
I'm not sure that you completely understand what ECIES consists of:
http://en.wikipedia.org/wiki/Integrated_Encryption_Scheme
That's quite a bit of work, and it requires a whole lot of primitives, including at least one symmetric primitive, it seems to me. That might as well be AES.
Let's start from the last sentence of the question:
All I am looking for is to use a "Private key" to encrypt firmware and the bootloader uses "Public Key" to decrypt it.
There's some confusion in terminology here. Private keys are used to decrypt (or sign) and public keys are used to encrypt (or verify). If I understand correctly, what you want is for the bootloader to verify a signature on the firmware so that only a firmware that was properly signed by yourself will be accepted by the bootloader.
There are various asymmetric signature schemes which can be used for this purpose, including some which are based on eliptic curve cryptography. For example you could use the OpenSSL implementation of ECDSA (see http://www.openssl.org/docs/crypto/ecdsa.html).
I'm afraid there's not enough information in the question to properly choose the best signature scheme (and possibly an encryption scheme as well if there is a need to keep the firmware secret). In any case, good cryptography is not enough to make a system secure and other considerations such as secure implementation are no less important.
If this is is something that is important for you to protect and that you are worried that hackers may try to break, I would strongly advise procuring the services of a security professional. Using cryptography correctly is a very tricky business that requires a full understanding of the system - otherwise you may find yourself in a situation like this
If you look for "authentication" you have to use asymmetric algorithm like EC, this usually done because if the user or process want to update the "firmware" he should identify him self to the bootloader by his "signature" to check who request this update.
After that is done, the bootloader will load the symmetric key from a secure memory to decrypt what you want to do.
So, you have a symmetric key for encryption (AES), and asymmetric two keys for authentication (=Who are you?).
Note: there is no advantages of EC on 32 bit CPU executing at 60MHz for Encryption, unless your application need asymmetric for Encryption NOT authentication, this happen due to line between the user and bootloader is not secure.
Therefore, you could use bootloader's "public key" to encrypt firmware and the bootloader uses its "private Key" to decrypt it, however, the implementation cost a lot due to the high computing for asymmetric algorithm.
Look for "lightweight cryptography", it is typical for your application.
We are putting an HTTP RESTful interface into an embedded platform of ours. The hardware is too limited to support SSL, but we do use AES encryption for other things.
I'm thinking of using AES with a shared key to encrypt the data. Is there anything else that is at least a somewhat standard way of encrypting via HTTP?
The standard way of encrypting HTTP is SSL (or its successor TLS, nowadays) (this is then known as HTTPS).
As GregS asked in a comment, in what way is your platform too limited for SSL, but still allows AES? Does it have not enough computing power/memory to do modular exponentiation (which is used in RSA, DSA, Diffie-Hellman)?
Then you might be able to use a pre-shared key version of TLS. RFC 4279 defines cipher suites with pre-shared key authentication, where the TLS_PSK_WITH_AES_128_CBC_SHA looks like if needs only AES and SHA-1, no modular exponentiation.
Of course, you shouldn't use this if there is the danger that an attacker can get the secret (e.g. by cracking your device), since this allows also to read all previously registered connections (in contrast to Diffie-Hellman, which provides a new session key for each session).
Found this gem: Diffie-Hellman Key Exchange in 10 lines of C
http://www.cypherspace.org/rsa/dh-in-C.html
Does Node.JS support sending binary data? or does it require a Base64 layer?
Also, how best would I create an encryption layer? I am expecting I will create a module that acts exactly like the net module (as it pertains to tcp client/server communication) and then just call an underlying net module.
However, I would like the encryption layer to be easily added to a file I/O stream. Would those two operations have to work different?
I know little about Node.JS but I know Java and browser based JavaScript very well.
Yes, Node.js supports binary data.
For encrypted communication it has built-in support for SSL / TLS.
I'm connecting mi cell phone application in J2ME to a web service and I have to send a SHA256 hash to it in order to validate some data received. I also need to be capable to store some information encrypted into the cell phone. I was thinking to use AES (rinjdael) symmetric encryption.
Anyone knows about any code example using AES encryption in J2ME ?
I would advise looking into the open source bouncycastle library.
It has been successfully used for cryptography on J2ME.