I'm planning to setup a hybrid encryption procedure in my app. So basically i did encryption for data send from client to server using this method, now i'm confused on how to encrypt data send from server to client. So what i have done so for is that :

I generated a public-private key pair using an asymmetric encryption(RSA), saved the private key in server side and then shipped the public key with my app(client).Now when i need to send data to the server we generate a secret key and then encrypt our data with this secret key. Now we encrypt the secret key using the initially created public key(from asymmetric enc) and send this encrypted secret key and along with the encrypted data to server. Now the server can use its private key to decrypt the secret key and further use the decrypted secret key to decrypt the data

My question is that, how to encrypt the data from server to client using this method? should i create another asymmetric key pair for this, or is there a way to use the existing pair? I'm confused on decrypting part in client side since we can't save the private key in the app

  • 1
    If I understood it well, you just need to implement HTTPS communication to your web application. To understand how it works, take a look here: medium.com/sitewards/… – Emerson Cardoso Mar 4 at 10:45
  • "I'm planning to setup a hybrid encryption procedure in my app. " - there's a 99% chance you've made a mistake right here. – whatsisname Mar 4 at 13:23
  • @EmersonCardoso i have already implemented an https communication.So in a payments app, if there is a pen test by the bank team, this will be approved right? – Navneet Krishna Mar 4 at 14:35
  • 1
    @NavneetKrishna, Yes, provided you have restricted the TLS protocols and ciphers to only a known strong subset. See http2.github.io/http2-spec/#TLSUsage for a maintained set of strong ciphers. TLS 1.2 and higher only. – Berin Loritsch Mar 4 at 14:44
  • @BerinLoritsch thanks, currently 1.1 and 1.0 are enabled, i will restrict these – Navneet Krishna Mar 4 at 15:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.