Question

I’ve have an application which send request to server side. my concern is that, a hacker could snoop traffic and resend the request after doing some modification in request itself.

I know the best way to solve this problem is to use SSL, but I think that will be an over killer for simple application like my application, I’m thinking to go with simple thing like MD5 algorithm.

This way if hacker tried to modify the request and resent it, at least I will discover that.

my question is that:

• do you think this a good a approach, or you think there is a better way?
• does the MD5 that is generated on iOS using objective C, will have the same value that is generated in Linux server using Java?

Answer 1

Traditionally you would need to make a hash from your payload + timestamp + secret token. Since only client and server know the token, you should be able to verify the hash correctly. And don’t forget to include the timestamp in the transmission!
You may also want to encrypt the whole thing before sending – if the information is sensitive (like passwords, etc).

I believe MD5 will match if made on different systems (if done correctly).