Cryptographic algorithms for protecting
sensitive data in mobile applications
Introduction
In today’s digital world, sensitive data such as financial information,
healthcare records and national identification numbers are becoming
increasingly digitized. Mobile devices like smartphones and tablets have
become ubiquitous and are regularly used to store and access this sensitive
data. However, they also present unique security challenges compared to
desktop computers due to their portable nature and more limited
computational resources. Malicious actors may try to steal sensitive data
from lost, stolen or compromised mobile devices. It is therefore crucial for
mobile applications dealing with sensitive information to employ robust
cryptographic techniques to protect user data both during transmission and
at rest.
This paper will discuss some of the most widely used and effective
cryptographic algorithms suitable for securing sensitive data in mobile
applications. It will first provide an overview of cryptographic algorithms and
their basic workings. It will then delve into specific algorithms including AES,
3DES, RSA, ECC and hash functions that are well-suited for usage on
resource-constrained mobile devices. Implementation considerations and
best practices for securely deploying these algorithms in mobile apps will
also be covered. The goal is to provide mobile developers with an
understanding of how cryptographic algorithms can help protect users’
sensitive data and privacy on their phones and tablets.
Cryptographic Algorithms Overview
Cryptographic algorithms use mathematical principles to encrypt data into
ciphertext that cannot be understood by unauthorized parties. The main
classes of cryptographic algorithms relevant to data protection are:
- Symmetric-key algorithms: Use the same secret key to both encrypt
and decrypt data. Examples include AES, 3DES.
- Asymmetric-key (public-key) algorithms: Use a pair of keys – a public
key to encrypt data, and a private key to decrypt it. Examples include
RSA, Elliptic Curve Cryptography (ECC).
- Hash functions: Calculate a unique hash value for a given input but
cannot derive the original input from the hash. Examples include
SHA256, SHA512.
Symmetric-key algorithms are generally faster than asymmetric algorithms
and more suitable for encrypting large amounts of data. However, they
require a secure channel to share the secret key between communicating
parties. Asymmetric algorithms solve this key distribution problem but are
slower. Hash functions are not encryption algorithms but have important
uses like message integrity checks and password storage.
Popular Symmetric-key Algorithms for Mobile Apps
Advanced Encryption Standard (AES):
AES is a block cipher adopted as an encryption standard by NIST in 2001. It
performs encryption and decryption on fixed-size blocks using a secret
symmetric key. AES has key sizes of 128, 192 or 256 bits, with a block size of
128 bits. It is very fast even on low-powered devices and is highly secure if
implemented correctly. AES is thus well-suited for mobile use cases like
encrypting sensitive user files, databases and network traffic.
Triple DES (3DES):
3DES applies the DES algorithm three times using two or three different
keys. It remains in common use due to backward compatibility needs, though
AES is faster. 3DES has an effective key length of 112 or 168 bits and
remains secure if only used for legacy systems. On modern mobile hardware,
AES should generally be preferred over 3DES.
Popular Asymmetric Algorithms for Mobile Apps
RSA:
RSA is the most common public-key algorithm relying on the difficulty of
factoring large prime numbers. It can encrypt small blocks of data very
quickly. For mobile apps, RSA is well-suited for key exchange during TLS/SSL
handshakes and digitally signing small amounts of data. However, its
performance degrades rapidly with larger encryption block sizes.
Elliptic Curve Cryptography (ECC):
ECC relies on operations over elliptic curve groups rather than on the
difficulty of factoring primes. It provides equivalent security to RSA but with
smaller key sizes, reducing processor and bandwidth overheads. For
example, an ECC key of just 256 bits offers similar security level to a 3,000+
bit RSA key. ECC is faster than RSA across various block sizes and thus better
optimized for mobile use cases involving digital signatures, key exchange
and encryption of larger data payloads.
Hash Functions for Mobile Apps
Cryptographic hash functions are a fundamental building block in many
security applications. Widely used hash functions with proven security
suitable for mobile use include:
SHA-2 family (SHA-256, SHA-512):
The Secure Hash Algorithm 2 family specified by NIST, calculates digest
values of various bit lengths from input data. They are very fast and collision-
resistant even for powerful adversaries. SHA-2 forms the basis for digital
signatures, message authentication codes and file integrity checks in mobile
apps.
Implementation Considerations
When implementing cryptography in mobile apps, some best practices
should be followed:
- Use well-studied, standardized algorithms like AES, RSA, ECC, SHA-2
that have undergone extensive scholarly review. Avoid
proprietary/homegrown cryptographic techniques.
- Generate strong, cryptographically secure random keys and
initialization vectors instead of hardcoded values or weak PRNGs prone
to prediction.
- Store keys securely, for example using keystores protected by device
authentication like biometric matching. Never hardcode or expose keys
in source code or memory dumps.
- For static encryption keys, consider using key derivation functions like
PBKDF2 to securely derive encryption keys from user passwords.
- Use valid certificate chains and SSL/TLS for transport security when
transmitting sensitive data over networks.
- Include integrity checks like Message Authentication Codes or digital
signatures to prevent unauthorized data tampering.
- Perform encryption on the mobile device instead of in the cloud to
avoid exposing unencrypted user data externally.
- Use library implementations from vetted sources instead of writing
crypto code from scratch which is error-prone.
- Consider mobile platform built-in cryptographic services where
available for key generation/storage and cryptographic operations.
- Avoid side-channel attacks on cryptographic implementations through
techniques like constant-time programming.
With care taken in algorithm selection, key management and implementation
best practices, cryptographic techniques provide a robust method on mobile
apps to help protect users’ sensitive data and preserve their privacy. When
combined with other security controls, crypto delivers an important layer of
data confidentiality and integrity assurance.
Case Study: Securing a Healthcare Mobile App
As a case study, consider how cryptography could be applied to secure
sensitive user data in a mobile app for managing personal healthcare
records.
Some key security and privacy requirements for such an app include:
- Encrypting stored healthcare records, lab results, insurance details and
other personal medical information on the device.
- Digitally signing records when sharing with health providers to
guarantee authenticity and prevent tampering.
- Securely transmitting encrypted health data to remote servers or other
apps during sync or sharing functionality.
- Strongly authenticating the user, for example through biometric
matching, before allowing access to private records.
Here is one way cryptography could help meet these requirements:
- AES-256 in GCM mode would encrypt user’s healthcare databases and
files stored on the device, using keys protected in the platform
keystore.
- Elliptic Curve Digital Signature Algorithm (ECDSA) with a 256-bit curve
like secp256k1 could sign individual records during sharing.
- TLS 1.3 would secure the network transport when syncing or
transmitting records externally, using an ECC key exchange and server
authentication.
- Local user authentication could leverage the platform biometrics API
and secure enclave, hashing and salting captured biometrics before
comparison.
- For extra security, keys would be derived from user credentials using
PBKDF2-SHA512 before storage in keystore.
- Integrity checks like HMAC-SHA512 could detect any unauthorized
database modifications.
Implementing cryptography in a carefully designed manner as outlined
above could help the healthcare mobile app meet regulatory privacy
mandates while offering patients strong assurance around the
confidentiality, integrity and authenticity of their personal medical records.
This highlights how even resource-constrained mobile platforms enable
robust data security with the right cryptographic choices.
Future Directions
As the amount of sensitive data we store on our phones increases
exponentially every year, so does the need for cryptographic protections to
evolve. Some emerging areas in mobile application security include:
- Homomorphic encryption schemes enabling computation directly on
encrypted data could allow certain operations without ever decrypting
sensitive user records.
- Secure enclaves like the ARM TrustZone and new hardware security
modules provide isolated execution environments optimized for
cryptographic operations outside the app sandbox.
- Post-quantum cryptographic algorithms are being standardized to
future-proof systems against quantum computer attacks that could
break RSA and ECC. NIST is evaluating candidate algorithms.
- New forms of digital identity and verifiable credentials enabled by
blockchain/distributed ledger technologies raise novel requirements
around privacy and linkage of identity attributes across devices and
organizations.
Additionally, with the explosive growth of Internet of Things (IoT) devices,
techniques like encryption, digital signatures and ephemeral keys will prove
crucial to securely connect, authenticate and manage interactions between
user smartphones and billions of IoT sensors/gadgets.
Addressing the privacy and security challenges from new technologies,
usage patterns and threat models will require further innovation and
standardization across cryptographic algorithms, protocols and
implementations. Mobile platforms are at the forefront driving this evolution
to protect users in an increasingly networked and data-centric world.
Conclusion
This paper provided an overview of foundational cryptographic algorithms
such as AES, RSA and SHA that are especially well-suited to the constrained
capabilities of mobile devices while providing robust security. Implementation
best practices around topics such as key management, transport security
and integration with platform services were also discussed.
A case study demonstrated how these cryptographic techniques can be
combined to build a secure mobile healthcare app meeting regulatory
privacy mandates. Factors like encryption of stored data, digital signatures,
network security and biometric authentication were examined.
As personal data becomes ever more digitized across a growing plethora of
internet-connected devices, rigorous cryptographic protections will prove
increasingly necessary to preserve user privacy, maintain data integrity and
guard against unauthorized access. With care taken in techniques, standards
and practices, modern cryptography enables the secure development of
powerful mobile applications capable of handling sensitive user information
responsibly and safely.
In today’s digital world, sensitive data such as financial information,
healthcare records and national identification numbers are becoming
increasingly digitized. Mobile devices like smartphones and tablets have
become ubiquitous and are regularly used to store and access this sensitive
data. However, they also present unique security challenges compared to
desktop computers due to their portable nature and more limited
computational resources. Malicious actors may try to steal sensitive data
from lost, stolen or compromised mobile devices. It is therefore crucial for
mobile applications dealing with sensitive information to employ robust
cryptographic techniques to protect user data both during transmission and
at rest.
This paper will discuss some of the most widely used and effective
cryptographic algorithms suitable for securing sensitive data in mobile
applications. It will first provide an overview of cryptographic algorithms and
their basic workings. It will then delve into specific algorithms including AES,
3DES, RSA, ECC and hash functions that are well-suited for usage on
resource-constrained mobile devices. Implementation considerations and
best practices for securely deploying these algorithms in mobile apps will
also be covered. The goal is to provide mobile developers with an
understanding of how cryptographic algorithms can help protect users’
sensitive data and privacy on their phones and tablets.
Cryptographic Algorithms Overview
Cryptographic algorithms use mathematical principles to encrypt data into
ciphertext that cannot be understood by unauthorized parties. The main
classes of cryptographic algorithms relevant to data protection are:
- Symmetric-key algorithms: Use the same secret key to both encrypt
and decrypt data. Examples include AES, 3DES.
- Asymmetric-key (public-key) algorithms: Use a pair of keys – a public
key to encrypt data, and a private key to decrypt it. Examples include
RSA, Elliptic Curve Cryptography (ECC).
- Hash functions: Calculate a unique hash value for a given input but
cannot derive the original input from the hash. Examples include
SHA256, SHA512.
Symmetric-key algorithms are generally faster than asymmetric algorithms
and more suitable for encrypting large amounts of data. However, they
require a secure channel to share the secret key between communicating
parties. Asymmetric algorithms solve this key distribution problem but are
slower. Hash functions are not encryption algorithms but have important
uses like message integrity checks and password storage.
Popular Symmetric-key Algorithms for Mobile Apps
Advanced Encryption Standard (AES):
AES is a block cipher adopted as an encryption standard by NIST in 2001. It
performs encryption and decryption on fixed-size blocks using a secret
symmetric key. AES has key sizes of 128, 192 or 256 bits, with a block size of
128 bits. It is very fast even on low-powered devices and is highly secure if
implemented correctly. AES is thus well-suited for mobile use cases like
encrypting sensitive user files, databases and network traffic.
Triple DES (3DES):
3DES applies the DES algorithm three times using two or three different
keys. It remains in common use due to backward compatibility needs, though
AES is faster. 3DES has an effective key length of 112 or 168 bits and
remains secure if only used for legacy systems. On modern mobile hardware,
AES should generally be preferred over 3DES.
Popular Asymmetric Algorithms for Mobile Apps
RSA:
RSA is the most common public-key algorithm relying on the difficulty of
factoring large prime numbers. It can encrypt small blocks of data very
quickly. For mobile apps, RSA is well-suited for key exchange during TLS/SSL
handshakes and digitally signing small amounts of data. However, its
performance degrades rapidly with larger encryption block sizes.
Elliptic Curve Cryptography (ECC):
ECC relies on operations over elliptic curve groups rather than on the
difficulty of factoring primes. It provides equivalent security to RSA but with
smaller key sizes, reducing processor and bandwidth overheads. For
example, an ECC key of just 256 bits offers similar security level to a 3,000+
bit RSA key. ECC is faster than RSA across various block sizes and thus better
optimized for mobile use cases involving digital signatures, key exchange
and encryption of larger data payloads.
Hash Functions for Mobile Apps
Cryptographic hash functions are a fundamental building block in many
security applications. Widely used hash functions with proven security
suitable for mobile use include:
SHA-2 family (SHA-256, SHA-512):
The Secure Hash Algorithm 2 family specified by NIST, calculates digest
values of various bit lengths from input data. They are very fast and collision-
resistant even for powerful adversaries. SHA-2 forms the basis for digital
signatures, message authentication codes and file integrity checks in mobile
apps.
Implementation Considerations
When implementing cryptography in mobile apps, some best practices
should be followed:
- Use well-studied, standardized algorithms like AES, RSA, ECC, SHA-2
that have undergone extensive scholarly review. Avoid
proprietary/homegrown cryptographic techniques.
- Generate strong, cryptographically secure random keys and
initialization vectors instead of hardcoded values or weak PRNGs prone
to prediction.
- Store keys securely, for example using keystores protected by device
authentication like biometric matching. Never hardcode or expose keys
in source code or memory dumps.
- For static encryption keys, consider using key derivation functions like
PBKDF2 to securely derive encryption keys from user passwords.
- Use valid certificate chains and SSL/TLS for transport security when
transmitting sensitive data over networks.
- Include integrity checks like Message Authentication Codes or digital
signatures to prevent unauthorized data tampering.
- Perform encryption on the mobile device instead of in the cloud to
avoid exposing unencrypted user data externally.
- Use library implementations from vetted sources instead of writing
crypto code from scratch which is error-prone.
- Consider mobile platform built-in cryptographic services where
available for key generation/storage and cryptographic operations.
- Avoid side-channel attacks on cryptographic implementations through
techniques like constant-time programming.
With care taken in algorithm selection, key management and implementation
best practices, cryptographic techniques provide a robust method on mobile
apps to help protect users’ sensitive data and preserve their privacy. When
combined with other security controls, crypto delivers an important layer of
data confidentiality and integrity assurance.
Case Study: Securing a Healthcare Mobile App
As a case study, consider how cryptography could be applied to secure
sensitive user data in a mobile app for managing personal healthcare
records.
Some key security and privacy requirements for such an app include:
- Encrypting stored healthcare records, lab results, insurance details and
other personal medical information on the device.
- Digitally signing records when sharing with health providers to
guarantee authenticity and prevent tampering.
- Securely transmitting encrypted health data to remote servers or other
apps during sync or sharing functionality.
- Strongly authenticating the user, for example through biometric
matching, before allowing access to private records.
Here is one way cryptography could help meet these requirements:
- AES-256 in GCM mode would encrypt user’s healthcare databases and
files stored on the device, using keys protected in the platform
keystore.
- Elliptic Curve Digital Signature Algorithm (ECDSA) with a 256-bit curve
like secp256k1 could sign individual records during sharing.
- TLS 1.3 would secure the network transport when syncing or
transmitting records externally, using an ECC key exchange and server
authentication.
- Local user authentication could leverage the platform biometrics API
and secure enclave, hashing and salting captured biometrics before
comparison.
- For extra security, keys would be derived from user credentials using
PBKDF2-SHA512 before storage in keystore.
- Integrity checks like HMAC-SHA512 could detect any unauthorized
database modifications.
Implementing cryptography in a carefully designed manner as outlined
above could help the healthcare mobile app meet regulatory privacy
mandates while offering patients strong assurance around the
confidentiality, integrity and authenticity of their personal medical records.
This highlights how even resource-constrained mobile platforms enable
robust data security with the right cryptographic choices.
Future Directions
As the amount of sensitive data we store on our phones increases
exponentially every year, so does the need for cryptographic protections to
evolve. Some emerging areas in mobile application security include:
- Homomorphic encryption schemes enabling computation directly on
encrypted data could allow certain operations without ever decrypting
sensitive user records.
- Secure enclaves like the ARM TrustZone and new hardware security
modules provide isolated execution environments optimized for
cryptographic operations outside the app sandbox.
- Post-quantum cryptographic algorithms are being standardized to
future-proof systems against quantum computer attacks that could
break RSA and ECC. NIST is evaluating candidate algorithms.
- New forms of digital identity and verifiable credentials enabled by
blockchain/distributed ledger technologies raise novel requirements
around privacy and linkage of identity attributes across devices and
organizations.
Additionally, with the explosive growth of Internet of Things (IoT) devices,
techniques like encryption, digital signatures and ephemeral keys will prove
crucial to securely connect, authenticate and manage interactions between
user smartphones and billions of IoT sensors/gadgets.
Addressing the privacy and security challenges from new technologies,
usage patterns and threat models will require further innovation and
standardization across cryptographic algorithms, protocols and
implementations. Mobile platforms are at the forefront driving this evolution
to protect users in an increasingly networked and data-centric world.
Conclusion
This paper provided an overview of foundational cryptographic algorithms
such as AES, RSA and SHA that are especially well-suited to the constrained
capabilities of mobile devices while providing robust security. Implementation
best practices around topics such as key management, transport security
and integration with platform services were also discussed.
A case study demonstrated how these cryptographic techniques can be
combined to build a secure mobile healthcare app meeting regulatory
privacy mandates. Factors like encryption of stored data, digital signatures,
network security and biometric authentication were examined.
As personal data becomes ever more digitized across a growing plethora of
internet-connected devices, rigorous cryptographic protections will prove
increasingly necessary to preserve user privacy, maintain data integrity and
guard against unauthorized access. With care taken in techniques, standards
and practices, modern cryptography enables the secure development of
powerful mobile applications capable of handling sensitive user information
responsibly and safely.
In today’s digital world, sensitive data such as financial information,
healthcare records and national identification numbers are becoming
increasingly digitized. Mobile devices like smartphones and tablets have
become ubiquitous and are regularly used to store and access this sensitive
data. However, they also present unique security challenges compared to
desktop computers due to their portable nature and more limited
computational resources. Malicious actors may try to steal sensitive data
from lost, stolen or compromised mobile devices. It is therefore crucial for
mobile applications dealing with sensitive information to employ robust
cryptographic techniques to protect user data both during transmission and
at rest.
This paper will discuss some of the most widely used and effective
cryptographic algorithms suitable for securing sensitive data in mobile
applications. It will first provide an overview of cryptographic algorithms and
their basic workings. It will then delve into specific algorithms including AES,
3DES, RSA, ECC and hash functions that are well-suited for usage on
resource-constrained mobile devices. Implementation considerations and
best practices for securely deploying these algorithms in mobile apps will
also be covered. The goal is to provide mobile developers with an
understanding of how cryptographic algorithms can help protect users’
sensitive data and privacy on their phones and tablets.
Cryptographic Algorithms Overview
Cryptographic algorithms use mathematical principles to encrypt data into
ciphertext that cannot be understood by unauthorized parties. The main
classes of cryptographic algorithms relevant to data protection are:
- Symmetric-key algorithms: Use the same secret key to both encrypt
and decrypt data. Examples include AES, 3DES.
- Asymmetric-key (public-key) algorithms: Use a pair of keys – a public
key to encrypt data, and a private key to decrypt it. Examples include
RSA, Elliptic Curve Cryptography (ECC).
- Hash functions: Calculate a unique hash value for a given input but
cannot derive the original input from the hash. Examples include
SHA256, SHA512.
Symmetric-key algorithms are generally faster than asymmetric algorithms
and more suitable for encrypting large amounts of data. However, they
require a secure channel to share the secret key between communicating
parties. Asymmetric algorithms solve this key distribution problem but are
slower. Hash functions are not encryption algorithms but have important
uses like message integrity checks and password storage.
Popular Symmetric-key Algorithms for Mobile Apps
Advanced Encryption Standard (AES):
AES is a block cipher adopted as an encryption standard by NIST in 2001. It
performs encryption and decryption on fixed-size blocks using a secret
symmetric key. AES has key sizes of 128, 192 or 256 bits, with a block size of
128 bits. It is very fast even on low-powered devices and is highly secure if
implemented correctly. AES is thus well-suited for mobile use cases like
encrypting sensitive user files, databases and network traffic.
Triple DES (3DES):
3DES applies the DES algorithm three times using two or three different
keys. It remains in common use due to backward compatibility needs, though
AES is faster. 3DES has an effective key length of 112 or 168 bits and
remains secure if only used for legacy systems. On modern mobile hardware,
AES should generally be preferred over 3DES.
Popular Asymmetric Algorithms for Mobile Apps
RSA:
RSA is the most common public-key algorithm relying on the difficulty of
factoring large prime numbers. It can encrypt small blocks of data very
quickly. For mobile apps, RSA is well-suited for key exchange during TLS/SSL
handshakes and digitally signing small amounts of data. However, its
performance degrades rapidly with larger encryption block sizes.
Elliptic Curve Cryptography (ECC):
ECC relies on operations over elliptic curve groups rather than on the
difficulty of factoring primes. It provides equivalent security to RSA but with
smaller key sizes, reducing processor and bandwidth overheads. For
example, an ECC key of just 256 bits offers similar security level to a 3,000+
bit RSA key. ECC is faster than RSA across various block sizes and thus better
optimized for mobile use cases involving digital signatures, key exchange
and encryption of larger data payloads.
Hash Functions for Mobile Apps
Cryptographic hash functions are a fundamental building block in many
security applications. Widely used hash functions with proven security
suitable for mobile use include:
SHA-2 family (SHA-256, SHA-512):
The Secure Hash Algorithm 2 family specified by NIST, calculates digest
values of various bit lengths from input data. They are very fast and collision-
resistant even for powerful adversaries. SHA-2 forms the basis for digital
signatures, message authentication codes and file integrity checks in mobile
apps.
Implementation Considerations
When implementing cryptography in mobile apps, some best practices
should be followed:
- Use well-studied, standardized algorithms like AES, RSA, ECC, SHA-2
that have undergone extensive scholarly review. Avoid
proprietary/homegrown cryptographic techniques.
- Generate strong, cryptographically secure random keys and
initialization vectors instead of hardcoded values or weak PRNGs prone
to prediction.
- Store keys securely, for example using keystores protected by device
authentication like biometric matching. Never hardcode or expose keys
in source code or memory dumps.
- For static encryption keys, consider using key derivation functions like
PBKDF2 to securely derive encryption keys from user passwords.
- Use valid certificate chains and SSL/TLS for transport security when
transmitting sensitive data over networks.
- Include integrity checks like Message Authentication Codes or digital
signatures to prevent unauthorized data tampering.
- Perform encryption on the mobile device instead of in the cloud to
avoid exposing unencrypted user data externally.
- Use library implementations from vetted sources instead of writing
crypto code from scratch which is error-prone.
- Consider mobile platform built-in cryptographic services where
available for key generation/storage and cryptographic operations.
- Avoid side-channel attacks on cryptographic implementations through
techniques like constant-time programming.
With care taken in algorithm selection, key management and implementation
best practices, cryptographic techniques provide a robust method on mobile
apps to help protect users’ sensitive data and preserve their privacy. When
combined with other security controls, crypto delivers an important layer of
data confidentiality and integrity assurance.
Case Study: Securing a Healthcare Mobile App
As a case study, consider how cryptography could be applied to secure
sensitive user data in a mobile app for managing personal healthcare
records.
Some key security and privacy requirements for such an app include:
- Encrypting stored healthcare records, lab results, insurance details and
other personal medical information on the device.
- Digitally signing records when sharing with health providers to
guarantee authenticity and prevent tampering.
- Securely transmitting encrypted health data to remote servers or other
apps during sync or sharing functionality.
- Strongly authenticating the user, for example through biometric
matching, before allowing access to private records.
Here is one way cryptography could help meet these requirements:
- AES-256 in GCM mode would encrypt user’s healthcare databases and
files stored on the device, using keys protected in the platform
keystore.
- Elliptic Curve Digital Signature Algorithm (ECDSA) with a 256-bit curve
like secp256k1 could sign individual records during sharing.
- TLS 1.3 would secure the network transport when syncing or
transmitting records externally, using an ECC key exchange and server
authentication.
- Local user authentication could leverage the platform biometrics API
and secure enclave, hashing and salting captured biometrics before
comparison.
- For extra security, keys would be derived from user credentials using
PBKDF2-SHA512 before storage in keystore.
- Integrity checks like HMAC-SHA512 could detect any unauthorized
database modifications.
Implementing cryptography in a carefully designed manner as outlined
above could help the healthcare mobile app meet regulatory privacy
mandates while offering patients strong assurance around the
confidentiality, integrity and authenticity of their personal medical records.
This highlights how even resource-constrained mobile platforms enable
robust data security with the right cryptographic choices.
Future Directions
As the amount of sensitive data we store on our phones increases
exponentially every year, so does the need for cryptographic protections to
evolve. Some emerging areas in mobile application security include:
- Homomorphic encryption schemes enabling computation directly on
encrypted data could allow certain operations without ever decrypting
sensitive user records.
- Secure enclaves like the ARM TrustZone and new hardware security
modules provide isolated execution environments optimized for
cryptographic operations outside the app sandbox.
- Post-quantum cryptographic algorithms are being standardized to
future-proof systems against quantum computer attacks that could
break RSA and ECC. NIST is evaluating candidate algorithms.
- New forms of digital identity and verifiable credentials enabled by
blockchain/distributed ledger technologies raise novel requirements
around privacy and linkage of identity attributes across devices and
organizations.
Additionally, with the explosive growth of Internet of Things (IoT) devices,
techniques like encryption, digital signatures and ephemeral keys will prove
crucial to securely connect, authenticate and manage interactions between
user smartphones and billions of IoT sensors/gadgets.
Addressing the privacy and security challenges from new technologies,
usage patterns and threat models will require further innovation and
standardization across cryptographic algorithms, protocols and
implementations. Mobile platforms are at the forefront driving this evolution
to protect users in an increasingly networked and data-centric world.
Conclusion
This paper provided an overview of foundational cryptographic algorithms
such as AES, RSA and SHA that are especially well-suited to the constrained
capabilities of mobile devices while providing robust security. Implementation
best practices around topics such as key management, transport security
and integration with platform services were also discussed.
A case study demonstrated how these cryptographic techniques can be
combined to build a secure mobile healthcare app meeting regulatory
privacy mandates. Factors like encryption of stored data, digital signatures,
network security and biometric authentication were examined.
As personal data becomes ever more digitized across a growing plethora of
internet-connected devices, rigorous cryptographic protections will prove
increasingly necessary to preserve user privacy, maintain data integrity and
guard against unauthorized access. With care taken in techniques, standards
and practices, modern cryptography enables the secure development of
powerful mobile applications capable of handling sensitive user information
responsibly and safely.
In today’s digital world, sensitive data such as financial information,
healthcare records and national identification numbers are becoming
increasingly digitized. Mobile devices like smartphones and tablets have
become ubiquitous and are regularly used to store and access this sensitive
data. However, they also present unique security challenges compared to
desktop computers due to their portable nature and more limited
computational resources. Malicious actors may try to steal sensitive data
from lost, stolen or compromised mobile devices. It is therefore crucial for
mobile applications dealing with sensitive information to employ robust
cryptographic techniques to protect user data both during transmission and
at rest.
This paper will discuss some of the most widely used and effective
cryptographic algorithms suitable for securing sensitive data in mobile
applications. It will first provide an overview of cryptographic algorithms and
their basic workings. It will then delve into specific algorithms including AES,
3DES, RSA, ECC and hash functions that are well-suited for usage on
resource-constrained mobile devices. Implementation considerations and
best practices for securely deploying these algorithms in mobile apps will
also be covered. The goal is to provide mobile developers with an
understanding of how cryptographic algorithms can help protect users’
sensitive data and privacy on their phones and tablets.
Cryptographic Algorithms Overview
Cryptographic algorithms use mathematical principles to encrypt data into
ciphertext that cannot be understood by unauthorized parties. The main
classes of cryptographic algorithms relevant to data protection are:
- Symmetric-key algorithms: Use the same secret key to both encrypt
and decrypt data. Examples include AES, 3DES.
- Asymmetric-key (public-key) algorithms: Use a pair of keys – a public
key to encrypt data, and a private key to decrypt it. Examples include
RSA, Elliptic Curve Cryptography (ECC).
- Hash functions: Calculate a unique hash value for a given input but
cannot derive the original input from the hash. Examples include
SHA256, SHA512.
Symmetric-key algorithms are generally faster than asymmetric algorithms
and more suitable for encrypting large amounts of data. However, they
require a secure channel to share the secret key between communicating
parties. Asymmetric algorithms solve this key distribution problem but are
slower. Hash functions are not encryption algorithms but have important
uses like message integrity checks and password storage.
Popular Symmetric-key Algorithms for Mobile Apps
Advanced Encryption Standard (AES):
AES is a block cipher adopted as an encryption standard by NIST in 2001. It
performs encryption and decryption on fixed-size blocks using a secret
symmetric key. AES has key sizes of 128, 192 or 256 bits, with a block size of
128 bits. It is very fast even on low-powered devices and is highly secure if
implemented correctly. AES is thus well-suited for mobile use cases like
encrypting sensitive user files, databases and network traffic.
Triple DES (3DES):
3DES applies the DES algorithm three times using two or three different
keys. It remains in common use due to backward compatibility needs, though
AES is faster. 3DES has an effective key length of 112 or 168 bits and
remains secure if only used for legacy systems. On modern mobile hardware,
AES should generally be preferred over 3DES.
Popular Asymmetric Algorithms for Mobile Apps
RSA:
RSA is the most common public-key algorithm relying on the difficulty of
factoring large prime numbers. It can encrypt small blocks of data very
quickly. For mobile apps, RSA is well-suited for key exchange during TLS/SSL
handshakes and digitally signing small amounts of data. However, its
performance degrades rapidly with larger encryption block sizes.
Elliptic Curve Cryptography (ECC):
ECC relies on operations over elliptic curve groups rather than on the
difficulty of factoring primes. It provides equivalent security to RSA but with
smaller key sizes, reducing processor and bandwidth overheads. For
example, an ECC key of just 256 bits offers similar security level to a 3,000+
bit RSA key. ECC is faster than RSA across various block sizes and thus better
optimized for mobile use cases involving digital signatures, key exchange
and encryption of larger data payloads.
Hash Functions for Mobile Apps
Cryptographic hash functions are a fundamental building block in many
security applications. Widely used hash functions with proven security
suitable for mobile use include:
SHA-2 family (SHA-256, SHA-512):
The Secure Hash Algorithm 2 family specified by NIST, calculates digest
values of various bit lengths from input data. They are very fast and collision-
resistant even for powerful adversaries. SHA-2 forms the basis for digital
signatures, message authentication codes and file integrity checks in mobile
apps.
Implementation Considerations
When implementing cryptography in mobile apps, some best practices
should be followed:
- Use well-studied, standardized algorithms like AES, RSA, ECC, SHA-2
that have undergone extensive scholarly review. Avoid
proprietary/homegrown cryptographic techniques.
- Generate strong, cryptographically secure random keys and
initialization vectors instead of hardcoded values or weak PRNGs prone
to prediction.
- Store keys securely, for example using keystores protected by device
authentication like biometric matching. Never hardcode or expose keys
in source code or memory dumps.
- For static encryption keys, consider using key derivation functions like
PBKDF2 to securely derive encryption keys from user passwords.
- Use valid certificate chains and SSL/TLS for transport security when
transmitting sensitive data over networks.
- Include integrity checks like Message Authentication Codes or digital
signatures to prevent unauthorized data tampering.
- Perform encryption on the mobile device instead of in the cloud to
avoid exposing unencrypted user data externally.
- Use library implementations from vetted sources instead of writing
crypto code from scratch which is error-prone.
- Consider mobile platform built-in cryptographic services where
available for key generation/storage and cryptographic operations.
- Avoid side-channel attacks on cryptographic implementations through
techniques like constant-time programming.
With care taken in algorithm selection, key management and implementation
best practices, cryptographic techniques provide a robust method on mobile
apps to help protect users’ sensitive data and preserve their privacy. When
combined with other security controls, crypto delivers an important layer of
data confidentiality and integrity assurance.
Case Study: Securing a Healthcare Mobile App
As a case study, consider how cryptography could be applied to secure
sensitive user data in a mobile app for managing personal healthcare
records.
Some key security and privacy requirements for such an app include:
- Encrypting stored healthcare records, lab results, insurance details and
other personal medical information on the device.
- Digitally signing records when sharing with health providers to
guarantee authenticity and prevent tampering.
- Securely transmitting encrypted health data to remote servers or other
apps during sync or sharing functionality.
- Strongly authenticating the user, for example through biometric
matching, before allowing access to private records.
Here is one way cryptography could help meet these requirements:
- AES-256 in GCM mode would encrypt user’s healthcare databases and
files stored on the device, using keys protected in the platform
keystore.
- Elliptic Curve Digital Signature Algorithm (ECDSA) with a 256-bit curve
like secp256k1 could sign individual records during sharing.
- TLS 1.3 would secure the network transport when syncing or
transmitting records externally, using an ECC key exchange and server
authentication.
- Local user authentication could leverage the platform biometrics API
and secure enclave, hashing and salting captured biometrics before
comparison.
- For extra security, keys would be derived from user credentials using
PBKDF2-SHA512 before storage in keystore.
- Integrity checks like HMAC-SHA512 could detect any unauthorized
database modifications.
Implementing cryptography in a carefully designed manner as outlined
above could help the healthcare mobile app meet regulatory privacy
mandates while offering patients strong assurance around the
confidentiality, integrity and authenticity of their personal medical records.
This highlights how even resource-constrained mobile platforms enable
robust data security with the right cryptographic choices.
Future Directions
As the amount of sensitive data we store on our phones increases
exponentially every year, so does the need for cryptographic protections to
evolve. Some emerging areas in mobile application security include:
- Homomorphic encryption schemes enabling computation directly on
encrypted data could allow certain operations without ever decrypting
sensitive user records.
- Secure enclaves like the ARM TrustZone and new hardware security
modules provide isolated execution environments optimized for
cryptographic operations outside the app sandbox.
- Post-quantum cryptographic algorithms are being standardized to
future-proof systems against quantum computer attacks that could
break RSA and ECC. NIST is evaluating candidate algorithms.
- New forms of digital identity and verifiable credentials enabled by
blockchain/distributed ledger technologies raise novel requirements
around privacy and linkage of identity attributes across devices and
organizations.
Additionally, with the explosive growth of Internet of Things (IoT) devices,
techniques like encryption, digital signatures and ephemeral keys will prove
crucial to securely connect, authenticate and manage interactions between
user smartphones and billions of IoT sensors/gadgets.
Addressing the privacy and security challenges from new technologies,
usage patterns and threat models will require further innovation and
standardization across cryptographic algorithms, protocols and
implementations. Mobile platforms are at the forefront driving this evolution
to protect users in an increasingly networked and data-centric world.
Conclusion
This paper provided an overview of foundational cryptographic algorithms
such as AES, RSA and SHA that are especially well-suited to the constrained
capabilities of mobile devices while providing robust security. Implementation
best practices around topics such as key management, transport security
and integration with platform services were also discussed.
A case study demonstrated how these cryptographic techniques can be
combined to build a secure mobile healthcare app meeting regulatory
privacy mandates. Factors like encryption of stored data, digital signatures,
network security and biometric authentication were examined.
As personal data becomes ever more digitized across a growing plethora of
internet-connected devices, rigorous cryptographic protections will prove
increasingly necessary to preserve user privacy, maintain data integrity and
guard against unauthorized access. With care taken in techniques, standards
and practices, modern cryptography enables the secure development of
powerful mobile applications capable of handling sensitive user information
responsibly and safely.
In today’s digital world, sensitive data such as financial information,
healthcare records and national identification numbers are becoming
increasingly digitized. Mobile devices like smartphones and tablets have
become ubiquitous and are regularly used to store and access this sensitive
data. However, they also present unique security challenges compared to
desktop computers due to their portable nature and more limited
computational resources. Malicious actors may try to steal sensitive data
from lost, stolen or compromised mobile devices. It is therefore crucial for
mobile applications dealing with sensitive information to employ robust
cryptographic techniques to protect user data both during transmission and
at rest.
This paper will discuss some of the most widely used and effective
cryptographic algorithms suitable for securing sensitive data in mobile
applications. It will first provide an overview of cryptographic algorithms and
their basic workings. It will then delve into specific algorithms including AES,
3DES, RSA, ECC and hash functions that are well-suited for usage on
resource-constrained mobile devices. Implementation considerations and
best practices for securely deploying these algorithms in mobile apps will
also be covered. The goal is to provide mobile developers with an
understanding of how cryptographic algorithms can help protect users’
sensitive data and privacy on their phones and tablets.
Cryptographic Algorithms Overview
Cryptographic algorithms use mathematical principles to encrypt data into
ciphertext that cannot be understood by unauthorized parties. The main
classes of cryptographic algorithms relevant to data protection are:
- Symmetric-key algorithms: Use the same secret key to both encrypt
and decrypt data. Examples include AES, 3DES.
- Asymmetric-key (public-key) algorithms: Use a pair of keys – a public
key to encrypt data, and a private key to decrypt it. Examples include
RSA, Elliptic Curve Cryptography (ECC).
- Hash functions: Calculate a unique hash value for a given input but
cannot derive the original input from the hash. Examples include
SHA256, SHA512.
Symmetric-key algorithms are generally faster than asymmetric algorithms
and more suitable for encrypting large amounts of data. However, they
require a secure channel to share the secret key between communicating
parties. Asymmetric algorithms solve this key distribution problem but are
slower. Hash functions are not encryption algorithms but have important
uses like message integrity checks and password storage.
Popular Symmetric-key Algorithms for Mobile Apps
Advanced Encryption Standard (AES):
AES is a block cipher adopted as an encryption standard by NIST in 2001. It
performs encryption and decryption on fixed-size blocks using a secret
symmetric key. AES has key sizes of 128, 192 or 256 bits, with a block size of
128 bits. It is very fast even on low-powered devices and is highly secure if
implemented correctly. AES is thus well-suited for mobile use cases like
encrypting sensitive user files, databases and network traffic.
Triple DES (3DES):
3DES applies the DES algorithm three times using two or three different
keys. It remains in common use due to backward compatibility needs, though
AES is faster. 3DES has an effective key length of 112 or 168 bits and
remains secure if only used for legacy systems. On modern mobile hardware,
AES should generally be preferred over 3DES.
Popular Asymmetric Algorithms for Mobile Apps
RSA:
RSA is the most common public-key algorithm relying on the difficulty of
factoring large prime numbers. It can encrypt small blocks of data very
quickly. For mobile apps, RSA is well-suited for key exchange during TLS/SSL
handshakes and digitally signing small amounts of data. However, its
performance degrades rapidly with larger encryption block sizes.
Elliptic Curve Cryptography (ECC):
ECC relies on operations over elliptic curve groups rather than on the
difficulty of factoring primes. It provides equivalent security to RSA but with
smaller key sizes, reducing processor and bandwidth overheads. For
example, an ECC key of just 256 bits offers similar security level to a 3,000+
bit RSA key. ECC is faster than RSA across various block sizes and thus better
optimized for mobile use cases involving digital signatures, key exchange
and encryption of larger data payloads.
Hash Functions for Mobile Apps
Cryptographic hash functions are a fundamental building block in many
security applications. Widely used hash functions with proven security
suitable for mobile use include:
SHA-2 family (SHA-256, SHA-512):
The Secure Hash Algorithm 2 family specified by NIST, calculates digest
values of various bit lengths from input data. They are very fast and collision-
resistant even for powerful adversaries. SHA-2 forms the basis for digital
signatures, message authentication codes and file integrity checks in mobile
apps.
Implementation Considerations
When implementing cryptography in mobile apps, some best practices
should be followed:
- Use well-studied, standardized algorithms like AES, RSA, ECC, SHA-2
that have undergone extensive scholarly review. Avoid
proprietary/homegrown cryptographic techniques.
- Generate strong, cryptographically secure random keys and
initialization vectors instead of hardcoded values or weak PRNGs prone
to prediction.
- Store keys securely, for example using keystores protected by device
authentication like biometric matching. Never hardcode or expose keys
in source code or memory dumps.
- For static encryption keys, consider using key derivation functions like
PBKDF2 to securely derive encryption keys from user passwords.
- Use valid certificate chains and SSL/TLS for transport security when
transmitting sensitive data over networks.
- Include integrity checks like Message Authentication Codes or digital
signatures to prevent unauthorized data tampering.
- Perform encryption on the mobile device instead of in the cloud to
avoid exposing unencrypted user data externally.
- Use library implementations from vetted sources instead of writing
crypto code from scratch which is error-prone.
- Consider mobile platform built-in cryptographic services where
available for key generation/storage and cryptographic operations.
- Avoid side-channel attacks on cryptographic implementations through
techniques like constant-time programming.
With care taken in algorithm selection, key management and implementation
best practices, cryptographic techniques provide a robust method on mobile
apps to help protect users’ sensitive data and preserve their privacy. When
combined with other security controls, crypto delivers an important layer of
data confidentiality and integrity assurance.
Case Study: Securing a Healthcare Mobile App
As a case study, consider how cryptography could be applied to secure
sensitive user data in a mobile app for managing personal healthcare
records.
Some key security and privacy requirements for such an app include:
- Encrypting stored healthcare records, lab results, insurance details and
other personal medical information on the device.
- Digitally signing records when sharing with health providers to
guarantee authenticity and prevent tampering.
- Securely transmitting encrypted health data to remote servers or other
apps during sync or sharing functionality.
- Strongly authenticating the user, for example through biometric
matching, before allowing access to private records.
Here is one way cryptography could help meet these requirements:
- AES-256 in GCM mode would encrypt user’s healthcare databases and
files stored on the device, using keys protected in the platform
keystore.
- Elliptic Curve Digital Signature Algorithm (ECDSA) with a 256-bit curve
like secp256k1 could sign individual records during sharing.
- TLS 1.3 would secure the network transport when syncing or
transmitting records externally, using an ECC key exchange and server
authentication.
- Local user authentication could leverage the platform biometrics API
and secure enclave, hashing and salting captured biometrics before
comparison.
- For extra security, keys would be derived from user credentials using
PBKDF2-SHA512 before storage in keystore.
- Integrity checks like HMAC-SHA512 could detect any unauthorized
database modifications.
Implementing cryptography in a carefully designed manner as outlined
above could help the healthcare mobile app meet regulatory privacy
mandates while offering patients strong assurance around the
confidentiality, integrity and authenticity of their personal medical records.
This highlights how even resource-constrained mobile platforms enable
robust data security with the right cryptographic choices.
Future Directions
As the amount of sensitive data we store on our phones increases
exponentially every year, so does the need for cryptographic protections to
evolve. Some emerging areas in mobile application security include:
- Homomorphic encryption schemes enabling computation directly on
encrypted data could allow certain operations without ever decrypting
sensitive user records.
- Secure enclaves like the ARM TrustZone and new hardware security
modules provide isolated execution environments optimized for
cryptographic operations outside the app sandbox.
- Post-quantum cryptographic algorithms are being standardized to
future-proof systems against quantum computer attacks that could
break RSA and ECC. NIST is evaluating candidate algorithms.
- New forms of digital identity and verifiable credentials enabled by
blockchain/distributed ledger technologies raise novel requirements
around privacy and linkage of identity attributes across devices and
organizations.
Additionally, with the explosive growth of Internet of Things (IoT) devices,
techniques like encryption, digital signatures and ephemeral keys will prove
crucial to securely connect, authenticate and manage interactions between
user smartphones and billions of IoT sensors/gadgets.
Addressing the privacy and security challenges from new technologies,
usage patterns and threat models will require further innovation and
standardization across cryptographic algorithms, protocols and
implementations. Mobile platforms are at the forefront driving this evolution
to protect users in an increasingly networked and data-centric world.
Conclusion
This paper provided an overview of foundational cryptographic algorithms
such as AES, RSA and SHA that are especially well-suited to the constrained
capabilities of mobile devices while providing robust security. Implementation
best practices around topics such as key management, transport security
and integration with platform services were also discussed.
A case study demonstrated how these cryptographic techniques can be
combined to build a secure mobile healthcare app meeting regulatory
privacy mandates. Factors like encryption of stored data, digital signatures,
network security and biometric authentication were examined.
As personal data becomes ever more digitized across a growing plethora of
internet-connected devices, rigorous cryptographic protections will prove
increasingly necessary to preserve user privacy, maintain data integrity and
guard against unauthorized access. With care taken in techniques, standards
and practices, modern cryptography enables the secure development of
powerful mobile applications capable of handling sensitive user information
responsibly and safely.
