iphone：有没有安全的方法可以从应用程序建立双向 SSL
我需要建立从我的 iPhone 应用程序到客户服务器的 HTTPS 2 路 SSL 连接。 但是，我没有看到任何安全的方法将客户端证书传递给应用程序（它是一个电子银行应用程序，因此安全性确实是一个问题）。 据我所知，到目前为止，应用程序能够访问证书的唯一方法是提供与应用程序本身预先捆绑的证书，或者公开可以从中获取证书的 URL (具有 SSL 客户端证书的 iPhone 应用）。
问题是，这两种方式都不会阻止某些第三方获取证书，如果将其视为风险，则无需使用双向 SSL（因为任何人都可以拥有客户端证书）。
整个安全协议应该如下所示：
- HTTPS 2 路 SSL 来验证应用程序
- 基于 OTP（令牌）的用户注册（在此步骤生成的客户端密钥对）
- SOAP / WSS XML 签名（由之前生成的密钥签名的请求）
有关如何建立第一层安全性 (HTTPS) 的任何想法吗？
I need to establish a HTTPS 2-way SSL connection from my iPhone application to the customer's server.
However I don't see any secure way to deliver the client side certificates to the application (it's an e-banking app, so security is really an issue).
From what I have found so far the only way that the app would be able to access the certificate is to provide it pre-bundeled with the application itself, or expose an URL from which it could be fetched (IPhone app with SSL client certs).
The thing is that neither of this two ways prevent some third party to get the certificate, which if accepted as a risk eliminates the need for 2-way SSL (since anyone can have the client certificate).
The whole security protocol should look like this:
- HTTPS 2-way SSL to authenticate the application
- OTP (token) based user registration (client side key pair generated at this step)
- SOAP / WSS XML-Signature (requests signed by the keys generated earlier)
Any idea on how to establish the first layer of security (HTTPS) ?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
好吧，所以回答我自己的问题......
事实证明，证券没有固定的衡量尺度。
只要制动系统的价格远高于这样做所获得的奖励，就可以满足安全要求。
就我而言，我们谈论的是电子银行系统，但每月限额较低（几千美元）。
正如我在问题中提到的，HTTPS 之上还有另一层安全层，它将采用 WSS XML 签名。注册用户并接受其公钥的过程也分几个步骤完成。第一步，用户发送他的电话号码以及从我的客户以某种方式检索到的代码。然后，系统会向用户发送一条包含确认码的短信。用户将确认码输入 OTP 计算器，该计算器将生成可识别用户身份的 OTP 代码。然后公钥与 OTP 代码一起发送到服务器。从这里开始，每个请求都将由之前发送到服务器的公钥的私有副本进行签名。
因此，整个过程的最大弱点是有人对应用程序进行逆向工程并检索用于 SLL 的客户端证书。由此产生的唯一问题是有人可能会观察用户的交易。然而，为了让某人进行交易，他需要用户的私钥，该私钥被生成、加密并存储到钥匙串中。打破这个安全级别的代价非常高。
我们还将考虑如何在更高级别上保护用户的数据（例如使用 WSS 加密），但首先我认为我们对当前的解决方案很满意。
有什么意见吗？
问候
Ok, so to answer my own question...
It turned out that the security has no fixed scale of measurement.
The security requirements are satisfied as long as the price for braking the system is significantly above the prize that one would get for doing so.
In my situation we are talking about e-banking system, but with somewhat low monthly limits (couple of thousands USD).
As I mentioned in my question there would be another layer of security above the HTTPS which will feature WSS XML-Signatures. The process of registering the user and accepting the his public key is also done in several steps. In the first step the user sends his telephone number together with a cod retrieved somehow from my client. Then an SMS is sent to the user with a confirmation code. The user enters the confirmation code into a OTP calculator that would produce OTP code which will identify the user. Then the public key is sent to the server together with the OTP code. From here on every request would be signed by the private counterpart of the public key sent to the server earlier.
So the biggest weakness for the whole process is that of someone reverse engineers the application and retrieves the client certificate used for the SLL. The only problem arising from this is that someone might observe users' transactions. However in order for someone to make a transaction he would need the user's private key, which is generated, encrypted and stored into the keychain. And the price for braking this security level is VERY HIGH.
We will additionally think on how to protect the users' data on a higher level (e.g. using WSS Encryption), but for the start I thing we are good with the current solution.
any opinion ?
regards
https 实际上并不是这样工作的。简而言之，您连接到一个安全服务器，其中的证书由知名机构签名。如果您为此使用 Apples (iPhone) 类，他们将只接受“良好”证书。我所说的“好”是指苹果认为可以接受的。如果您不使用它们（SDK 中有替代方案），您将无法连接（除非您拥有“企业”开发人员许可证 - 但我不能这样说100% 确定，因为我还没有充分查看此许可证来确定）
要继续，请使用您的 https 连接到正确签名的网站，然后使用内置用户名/密码或基于以下内容的质询/响应进行某种登录iPhone 的唯一 ID（例如）并使用该连接交换密钥。
请注意，这意味着您的应用程序必须在（每个连接/每 X 个连接/每月/应用程序指定的时间间隔）查询新证书，以使其保持最新。然后，您可以使用这些证书连接到更安全的服务器。
[编辑]
查看这篇帖子 - 可能有更多关于您的信息要求执行
[/edit]
[edit2]
请注意，请求是针对 iphone，而不是 OSX - 应用程序商店批准是一个问题
[/edit2]
https doesn't really work this way. In a nutshell, you attach to a secure server where the certificates are signed by a well known authority.If you use Apples (iPhone) classes for this, they will only accept 'good' certificates. By good, I mean what Apple deems as acceptable. If you don't use them (there are alternatives in the SDK), you won't be able to connect (except, maybe, in the case where you have an 'Enterprise' developers license - but I can't say that with 100% certainty as I haven't looked enough at this license to be sure)
To continue, use your https connection to your correctly signed website and then institute some sort of login with a built in username/password, or challenge/response based upon the unique ID of the iPhone (for example) and exchange keys using that connection.
Note that this means that your application will have to query for new certificates at (each connection/every X connections/every month/application specified intervals) to keep them up to date. You can then use these certificates to connect to the more secure server.
[edit]
Check this post - may have more information about what you're asking to do
[/edit]
[edit2]
Please note that the request is iphone, not OSX - app store approval is an issue
[/edit2]