which encryption algorithm to use for sending encrypted data from android apk to remote server vice versa

Question

I need to connect to a web service on a remote server, and need to pass all parameters in encrypted form for method calls, and the response from the server needs to be in encrypted form as well.

APK  ----->encrypted input parameters for method calling ---->remote server
Remote Server ------>decrypt the input parameters and response with same encrpted alg.

The point is I want to use one key (symmetric encryption) for encryption and decryption. Please let me know which code to use for that in android so that it will work correctly in both APK and REMOTE SERVER (Which is Java web service).

frankly speaking, I have used some algorithms such as DES;

but don't know why sometimes what is encrypted at APK side is not decrypted at REMOTE and null is returned!

One more thing, I want you guys to comment on this: "In order to avoid forgery requests, I used one variable called ReqID at APK side with initial value of 1, and at remote server's web service side I also used a reqID in DB for that client. And with each request comming from APK the reqID is read and appended to a key (that is reqID+key) and used it for encrypting the input parameters of any desired method of the web service, and at server side by receiving that request, the last reqID for that client is read from the DB as well as the key, and used for decrypting the input parameters. And after this, the reqID is increased by one at server side, and at APK side as well to make them be synced. But the issue is sometimes the decrypt at SERVER side doesn't work and returns null and sometimes at APK side while decrypting it fails and return null! What is the solution?

Answer 1

Use HTTPS, there is no need to add any additional encryption.

On the server use TLS 1.2 and Perfect Forward Secrecy. Everything will be encrypted including the query parameters. But the query parameters may be caught in server logs so it is best to send sensitive information as a POST.

Pin the server certificate in the app to prevent MITM attacks.