An Android/Iphone app will be accessing application data from the server. [Django-Python]

How can I secure the communication with the mobile app ?

Expectation : Secure enough for sensitive information like passwords, there shall be no direct way of decryption except brute-forcing.

My requirements :

  • Authentication [Only the app is authorized]
  • Integrity [Messages should not be modified in between]
  • Privacy [Communication should not be readable if sniffed]

My effort:

  • SSL authenticates only the Server, not the client.
  • I can-not use a symmetric encryption [Provides only Privacy]
  • Digital signature is not possible [Lacks Privacy]
  • PGP full-fills all 3 requirements.

Problem :

  • PGP requires to store keys on client app.
  • There seems to be no assuring way of securing keys on client app.
  • If the key is out, then PGP or Symmetric encryption are equally vulnerable.
  • Reverse-Engineering PGP keys or symmetic keys is equally hard.
  • In that case PGP is a non-sense burden on the mobile processor.
  • OAuth is again useless, since it also have a client key.

So, how can/should I move forward on this ? How does the industry deals with this ?

Should I implement casual approach :

  • Use simple SSL and cross my fingers ?, since authentication is not possible if the keys are stolen? (Only server authentication is possible with this)

Update:

Conclusion was to use AES, since if I can keep the key secure then I am as good as SSL. Plus I can keep changing the key over-time for better security. Contribute if you think there is a better way, do read the entire post before posting.

android iphone python django security
Edit
Report