Achieving AES-256 Channel Encryption with the .NET Compact Framework

Question

Hi There,

I am working on a business application where the clients are Windows Mobile 6.1 Professional devices. The server is a Java enterprise application.

The industry working group recommends AES-256 encryption for client/server communications. This is necessary to gain certification. The encryption doesn't necessarily need to be channel encryption, it could be payload encryption. Channel encryption is preferable.

The client and server communicate using SOAP/HTTP, which we are yet to implement. We plan to use WCF on the compact framework. In order to alleviate some of the work required to implement manual encryption/decryption, it would be nice if we could achieve the required encryption either at the TLS level, or somehow using the WS-* standards (I'm not particularly familiar with that group of technologies but I am learning right now). The server supports https with 256-bit AES.

Does anybody have an idea on the best way to implement this?

Thanks in advance.

Answer 1

Channel encryption is likely to be the easiest and most flexible to implement. Using it reduces the dependency between client and server code. The client just needs to make HTTPS calls to the server location. For security alone, you take on a lot of the burden at the application level with WS-Security.

If you need to pass the data through intermediaries that are not fully trusted then payload encryption is going to be more of a requirement.