I want to develop a mobile bank app (windows phone, android, ios) that interact

Question

I want to develop a mobile bank app (windows phone, android, ios) that interact with bank channel. first time when user opens application the key exchange process begins and at end of this process a long-term SymmetricKey generates and must store in mobile device. all of request that sends to server encrypt with this key. if someone can steal the SymmetricKey he/she can hijack the user session. in simple way i can store SymmetricKey in plain text format. another solution is that define a MasterKey in Code (Hardcode) and encrypt the SymmetricKey with the MasterKey. but in this solution there is exists exactly one MasterKey for several instance of app that installs in different devices. if some one can decompile the mobile app code and retrieve MasterKeyhe/she can retrieve SymmetricKey Again . what is the best solution for store sensitive data in mobile application? i read about some method that belongs to mobile os that guarantee that data is securely stored but all the of them needs to user set Profile Account (eg : Protect() and Unprotect() in windows phone that needs hotmail account to be set). can i generate different master keys per different device?

Explanation / Answer

For android phones, there is a credential storage that allows you to store keys. It runs as a system daemon and uses AES to encrypt the keys. The keys are tied to the UID of the app that created it so other rogue apps are unable to access these keys.

For iOS, there is a similar keychain which serves a similar purpose. It is also encrypted and sandboxed so applications can only retrieve their own keychain items.

Do not store the symmetric key in plain text. Although application storage in android is only accessible to the app itself, there is a probability that user may move the app to the SD card which is then fair game for all apps with the permissions to access the SD card.

I do not think a master key is necessary since the credential storage and keychain both provide encryption already.

However, it might be good to use the symmetric key as a shared secret to negotiate a new session key for every session probably through Diffie

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.