Question

We are putting an HTTP RESTful interface into an embedded platform of ours. The hardware is too limited to support SSL, but we do use AES encryption for other things.

I’m thinking of using AES with a shared key to encrypt the data. Is there anything else that is at least a somewhat standard way of encrypting via HTTP?

Answer 1

The standard way of encrypting HTTP is SSL (or its successor TLS, nowadays) (this is then known as HTTPS).

As GregS asked in a comment, in what way is your platform too limited for SSL, but still allows AES? Does it have not enough computing power/memory to do modular exponentiation (which is used in RSA, DSA, Diffie-Hellman)?

Then you might be able to use a pre-shared key version of TLS. RFC 4279 defines cipher suites with pre-shared key authentication, where the TLS_PSK_WITH_AES_128_CBC_SHA looks like if needs only AES and SHA-1, no modular exponentiation.

Of course, you shouldn’t use this if there is the danger that an attacker can get the secret (e.g. by cracking your device), since this allows also to read all previously registered connections (in contrast to Diffie-Hellman, which provides a new session key for each session).