Iphone: is there a safe way to establish 2-way SSL from an application

Question

I need to establish an HTTPS 2-way SSL connection from my iPhone application to a client server. However, I don’t see a safe way to deliver certificates on the client side to the application (this is an electronic banking application, so security is really a problem). From what I have found so far, the only way the application will be able to access the certificate is to provide it previously attached to the application itself or set a URL from which it can be extracted ( IPhone application with SSL client certificates )

The fact is that none of these two methods allows any third party to obtain a certificate, which, if taken as a risk, eliminates the need to use two-way SSL (since anyone can have a client certificate).

The entire security protocol should look like this:
- HTTPS 2-way SSL for application authentication
- User registration based on OTP (token) (pair side of the client side generated at this stage)
- SOAP / WSS XML Signature (requests signed with keys generated earlier)

Any idea on how to set the first level of security (HTTPS)?

Answer 1

Well, therefore, to answer my own question ...

It turned out that safety does not have a fixed measurement scale. Safety requirements are met if the price for braking the system significantly exceeds the gain that can be obtained for this.

In my situation, we are talking about an electronic banking system, but with small monthly limits (a couple of thousand US dollars). As I mentioned in my question, over HTTPS there will be another layer of security that will contain WSS XML signatures. The process of registering a user and accepting his public key is also carried out in several stages. At the first stage, the user sends his phone number along with a crack received in some way from my client. Then an SMS code with a confirmation code is sent to the user. The user enters a verification code into the OTP calculator, which creates an OTP code that will identify the user. Then the public key is sent to the server along with the OTP code. From here, each request must be signed by a private instance of the public key sent to the server earlier.

Thus, the biggest weakness for the whole process is that someone calls the application engineers and retrieves the client certificate used for the SLL. The only problem that arises from this is that someone can observe user transactions. However, in order for someone to complete the transaction, he needs the user's secret key, which is generated, encrypted and stored in the key chain. And the price for braking this level of security is VERY HIGH.

We will additionally think about how to protect user data at a higher level (for example, using WSS Encryption), but for a start I am sure that we are doing a good job with the current solution.

any opinion?

welcomes

Answer 2

https does not work this way. In a nutshell, you join a secure server where certificates are signed by a reputable authority.

If you use Apple (iPhone) classes for this, they will only accept "good" certificates. Fortunately, I mean what Apple considers acceptable. If you don’t use them (there are alternatives in the SDK), you won’t be able to connect (except, maybe, if you have an Enterprise developer license, but I can’t say that with 100% certainty, since I’m not enough looked at this license)

To continue, use your https connection on your correctly signed website, and then enter a kind of login with a built-in username / password or call / answer based on a unique iPhone identifier (for example) and exchange keys using this connection.

Please note that this means that your application will request new certificates (each connection / each connection X / each month / specified intervals) to keep them up to date. You can then use these certificates to connect to a more secure server.

[edit]

Check this post - there may be more information about what you are asking to do.

[/ edit]

[edit2]

Please note that the request is iphone, not OSX - app store approval is a problem

[/ edit2]