Android：我选择哪种加密方式，以使用WCF将数据安全地发送到应用程序？

Question

I have a project where I need to connect an Android App to an ERP that uses WCF, IIS (Internet Information Services), Active Directory and Role Based Scurity.

There are thus a lot of security options allready included by default like basicHttpBinding which allows the use of certificates and HTTPS and so on.

The one thing I haven't decided yet is what data encryption I'll use to secure the data when it travels from the app to the ERP. I have read that there is a Java AES library that can be used, then again I also read that somebody could also decrypt the packages if he or she intercepts them.

I was wondering two things:

• Is there a "Best Practice" concerning data encryption on mobile apps, since the computing power is not as strong as a computer's and the message can't be too heavy or long to decrypt since this would slow down the app which we do not want of course.

• I was actually thinking about using some kind of PGP public key where the public key is in the Android Devices and the private Key is in the ERP but maybe this is not a smart or even a very secure way to do it?

Then again.. since I'll be using TLS, maybe I don't need to encrypt my Data and it's secure enough?

Thanks in advance!

Answer 1

android is pretty much strait forward with their security protocols.

What you can do is use this function and find the protocol you would like to use:

Provider[] providers = Security.getProviders();
for (Provider provider : providers) {
    for (Object entry : provider.keySet()) {
        String name = String.valueOf(entry);
        if (name.startsWith("Cipher")) {
            Log.d("Cipher", "Supports: " + name.substring(7));
        }
    }
}

any one of those is a standart protocol and can be used both on the client side and the server side.

good luck.