Encrypted RequestParams For Secure API

Question

I am learning android and trying to make MY Application secure as much as possible. I have bought one android app which have below class

public class API {

    @SerializedName("sign")
    private String sign;
    @SerializedName("salt")
    private String salt;
    @SerializedName("package_name")
    private String package_name;

    public API(Activity activity) {
        String apiKey = "secretkey";
        salt = "" + getRandomSalt();
        sign = md5(apiKey + salt);
        package_name = activity.getApplication().getPackageName();
    }

    public API(Context context) {
        String apiKey = "secretkey";
        salt = "" + getRandomSalt();
        sign = md5(apiKey + salt);
        package_name = context.getApplicationContext().getPackageName();
    }

    private int getRandomSalt() {
        Random random = new Random();
        return random.nextInt(900);
    }

    private String md5(String input) {
        try {
            // Create MD5 Hash
            MessageDigest digest = java.security.MessageDigest.getInstance("MD5");
            digest.update(input.getBytes());
            byte messageDigest[] = digest.digest();

            // Create Hex String
            StringBuilder hexString = new StringBuilder();
            for (int i = 0; i < messageDigest.length; i++)
                hexString.append(String.format("%02x", messageDigest[i]));
            return hexString.toString();
        } catch (NoSuchAlgorithmException e) {
            e.printStackTrace();
            return null;
        }
    }

    public static String toBase64(String input) {
        byte[] encodeValue = Base64.encode(input.getBytes(), Base64.DEFAULT);
        return new String(encodeValue);
    }

}

And its using like below

JsonObject jsObj = (JsonObject) new Gson().toJsonTree(new API(Login.this));
        jsObj.addProperty("email", sendEmail);
        jsObj.addProperty("password", sendPassword);
        assert device != null;
        jsObj.addProperty("player_id", device.getUserId());
        jsObj.addProperty("method_name", "user_login");
        ApiInterface apiService = ApiClient.getClient().create(ApiInterface.class);
        Call<LoginRP> call = apiService.getLogin(API.toBase64(jsObj.toString()));

I think its securing data with encryption with API class

I am trying to use above method in my application but I am using RequestParams so I am not getting idea how I can use above in my case

RequestParams requestParam=new RequestParams();
        requestParam.put("mobile",mobile_number);
        requestParam.put("password","password");
AsyncHttpClient client = new AsyncHttpClient();
        client.get(BASE_URL+"login.php?",requestParams, new AsyncHttpResponseHandler() {

Let me know if anyone here can help me for solve my issue.

Thanks a lot!

Answer 1

As far as securing data, as long as you are using SSL/TLS, (even with GET), your data is encrypted during transfer.

That being said, the code above has MD5 and Base64 methods to convert the info to a hash. Using those functions, you can have a secret key shared between your app and the server, and use that key to encrypt/decrypt the hash values.

To make the md5 function more secure, you can create a know "salt" value rather than a random one, then update the function like this:

 public static String md5(String salt, String plainText)
        throws NoSuchAlgorithmException {
    MessageDigest md = MessageDigest.getInstance("MD5");

    if (salt != null) {
        md.update(salt.getBytes());
    }
    md.update(plainText.getBytes());

    byte byteData[] = md.digest();

    StringBuffer sb = new StringBuffer();
    for (int i = 0; i < byteData.length; i++) {
        sb.append(Integer.toString((byteData[i] & 0xff) + 0x100, 16)
                .substring(1));
    }
    return sb.toString();
}

And update the call like this:

requestParam.put("password", md5(md5(SALT_VALUE), md5(password));

Also, as a side-note, with GSON, you do not have to construct your own JSON objects, you can use the actual object reference and call .toJson()