RSA encryption technique implemetation in Worklight mobile application

1
votes

We are developing a banking mobile application using MobileFirst V7.1. As it is a banking mobile application security matters more the sensitive data from mobile client to MobileFirst server trasnferred securely. hence the data should be encrypted from the mobile client/App side and sent to the MobileFirst Server and at the server side we have to decrypt the data and call the backend webservice. As per the client requirement the following are the steps to be implemented for encryption logic:

Step 1: Generate a symmetric key A 32 bit random key will be generated

Step 2: Encrypt the data with this key, using a symmetric algorithm like AES. The sensitive data is encrypted with the above generated key using AES algorithm

Step 3: Encrypt the symmetric key with the public key, using a asymmetric algorithm like RSA. The key (32 bit random key generated in step1 an used for encryption of sensitive data in step2) is encrypted using the asymmetric algorithm RSA public key

Step 4: Bundle the encrypted symmetric key with the encrypted data Bundle both the encrypted sensitive data and encrypted random key in an object and sent it to the server. At the worklight server end, from step4 to step1 is performed in reverse to decrypt and get the original data

The problem is I'm able to achieve the encryption logic from step1 to stpe4 at the application end, but when I use the same RSA alogorithm java script libraries in the MobileFirst HTTP adapter side to decrypt the data, I'm getting many errors stating that "window" is undefined, "navigator" is undefined. The RSA javascript libraries consists of navigator, window, at the mobilefirst adapter javascript file these navigaotr or window is unavailable, hence I'm getting this errors and I'm unable to move forward. Can anyone please help me to resolve this or help me in implementing the Enctyprtion logic as mentioned in the above step1 to step4 in my MobileFirst application.

Thanks in adavance.

2
ibm-mobilefirstrsapublic-key-encryptionencryption-asymmetricmobilefirst-adapters
Why aren't you using HTTPS/TLS, it'll be far more secure than the poorly thought out mechanism above? – Iridium
Hi Iridium, Thanks for your reply. we are also using certificate pinning for our application. But client wants this encryption technique also be implemented along with certificate pinning. This is according to the client requirement. Thanks – Karthik_Chinna
1 If you use https with cert pinning you don't need these. It doesn't matter what clients think, if you are more professional than they are. – KOLANICH
2 If clients want, why not to ask them to use OpenPGP. For client-side encryption use gpg compiled for android or BouncyCastle, for server use gpg or any js implementations. As I understand, on the server you get errors because you try to use a library written for browser in server environment. You should either fix it or find another library. – KOLANICH

2 Answers

0
votes

Check this older response form stackoverflow:

I don't see issues on encrypting you adapter request/response payload(the data you send and receive inside of an adapter call). Worklight adapter calls are not encrypted (WL.Client.invokeProcedure)

Although, if you encrypt the entire request(or response) used by this will confuse the adapter Client/Server internal communication protocol.

If you want extra protection on on the transport layer(Like HTTP/HTTPS) and maybe an extra layer. I would check if in your case, a IBM DataPower would not what you are searching for: https://en.wikipedia.org/wiki/IBM_WebSphere_DataPower_SOA_Appliances

Application Layer: https://en.wikipedia.org/wiki/Application_layer

You can use also the adapter mash up technic at the adapter calls in a single adapter endpoint to prevent unwanted eyes to try ton reverse engineer this call by its name, and this 1st adapter can decrypt the payload at the server-side and send to the wanted adapter internally(inside the server-side).

https://mobilefirstplatform.ibmcloud.com/tutorials/en/foundation/8.0/adapters/advanced-adapter-usage-mashup/

I hope this helps,

0
votes

You have to write own code for encryption or decryption, I think you are using third party library to do encryption/decryption which is browser based. As worklight adpater does not recognize window/navigator.