this post was submitted on 22 Aug 2023
6 points (87.5% liked)
Web Development
3431 readers
1 users here now
Welcome to the web development community! This is a place to post, discuss, get help about, etc. anything related to web development
What is web development?
Web development is the process of creating websites or web applications
Rules/Guidelines
- Follow the programming.dev site rules
- Keep content related to web development
- If what you're posting relates to one of the related communities, crosspost it into there to help them grow
- If youre posting an article older than two years put the year it was made in brackets after the title
Related Communities
Wormhole
Some webdev blogs
Not sure what to post in here? Want some web development related things to read?
Heres a couple blogs that have web development related content
founded 1 year ago
MODERATORS
We are developing an application in which we will collaborate with a financial institution. That's why I think it should be extra secure and applicable against MITM attacks.
The process will work as follows;
I'm not sure if mutual authentication fits this.
mTLS would be sufficient and honestly more than enough, it sounds like. Plain TLS (client validates the server) will encrypt all traffic in transit end to end, using appropriate handshakes and symmetric cyphers. Anything using RSA directly will be significantly more likely to be incorrectly implemented and thus worthless.
mTLS would allow you to trust a CA per user, a cert per user, or issue your own keypairs for clients, depending on the use case. You validate the connection and look up the client based on some certificate field like CommonName or any of the other fields.
Then you've authenticated, and you can perform authorization for any transactions on that entire connection, plus you know for certain if it was MITMed it was done by someone with access to keys trusted by both parties.
So what part are you wanting to protect?
The user to your client? The client to you? Or essentially end-to-end between the user and you, but via your client?
Perhaps an alternative way?
The user sends the stock pool to the client, they give the user a transaction key. The user submits the transaction key to you, you fetch the transaction details from the client, then you process them?
I guess I'm failing to understand why the payload needs to be encrypted everything is already travelling over an encrypted medium (IE TLS/HTTPS).
The client wants to encrypt the payload while sending to us. I hope they know why they want this :)