Encryption between desktop app and server - C# to PHP -

i have app designed in c#. in simple terms app sends data , image web server takes $_post data , processes it. confess not understand how security end of things work. employ relevant experience wouldn't know ask them @ point in accepted techniques.

i assume not simple base64 encode/decode data , needs higher level of encryption. webserver have https ssl(ov) certification on next few weeks limited understanding still need sort of protection/encryption when transferring data users pc web server not listening in on data transfer or that.

in simple terms if want keep data secure between users , webserver of common or accepted methods c# php?

the data goes directly app on users pc server, control source code both myself , not developer hence lack of technical knowledge on issue.

one c# developer talked suggested symmetric/asymmetric algorithm not php developer doesn't know if php can take data , decrypt it.

to answer further questions, when server issued , configured cert, shouldn't need more.

using https

https works verifying ssl certifications certificate authority (ca) during initial handshake. certificate authorities, list of signatures used verify said certs, come preloaded os vendor.

assuming server has ca issued certificate, required change using http https when making connection. library you're using should have method of verifying servers ssl cert, if doesn't automatically you.

there no technical reason should have encrypt being sent on https, long certificate encrypted.

also, if dig deeper nitty-gritty details of how https works, there's this post on over information security sheds little light on inner workings of protocol.

to answer original question

for sake of completeness.

php has cryptography extension mcrypt supports various algorithms , cipher operation modes. i've put simple example using aes 256 / pbkdf-sha1 key decryption (along c# code perform encryption).

edit: i'd point out hash_pbkdf2 available in php 5.5 , up. support down 5.3 can added this nifty trick.

php

function decode_aes($data, $key) // decrypt custom format data string {     $iv_size = mcrypt_get_iv_size(mcrypt_rijndael_128, mcrypt_mode_cbc);     $salt_size = 16;      $iv = substr($data, 0, $iv_size); // init vector     $salt = substr($data, $iv_size, $salt_size); // salt     $extact = substr($data, $iv_size + $salt_size); // encrypted data      $key = hash_pbkdf2("sha1", $key, $salt, 1000, 32, true); // sets use pbkdf-sha1      return mcrypt_decrypt(mcrypt_rijndael_128, $key, $extact, mcrypt_mode_cbc, $iv); // perform decryption extracted sections }  // example, i've included this. $encryped = "zgcp2ssds32y8son8myfcejojdem4e3y8wx52a+itfrk/1tjwmzkqmrb06bfu8dk"; echo decode_aes(base64_decode($encryped), "password"); 

c#

using system; using system.text; using system.security.cryptography; using system.io;  namespace aesexample {     class program     {         static void main(string[] args)         {             byte[] toencrypt = encoding.utf8.getbytes("encrypted text");             byte[] key = encoding.utf8.getbytes("password");             string encrypted = convert.tobase64string(encryptaes(toencrypt, key));         }          public static byte[] encryptaes(byte[] data, byte[] key)         {             using(rijndaelmanaged algo = new rijndaelmanaged())             {                 algo.generateiv();                 algo.mode = ciphermode.cbc;                 algo.padding = paddingmode.zeros;                  byte[] saltbuffer = new byte[16];                 rngcryptoserviceprovider saltgenerator = new rngcryptoserviceprovider();                 saltgenerator.getbytes(saltbuffer);                  rfc2898derivebytes pbkdf2 = new rfc2898derivebytes(key, saltbuffer, 1000);                 key = pbkdf2.getbytes(32);                  icryptotransform cipher = algo.createencryptor(key, algo.iv);                  using(memorystream ms = new memorystream())                 {                     ms.write(algo.iv, 0, algo.iv.length);                     ms.write(saltbuffer, 0, saltbuffer.length);                     using(cryptostream cs = new cryptostream(ms, cipher, cryptostreammode.write))                     {                         using(streamwriter sw = new streamwriter(cs))                         {                             sw.write(encoding.utf8.getstring(data).tochararray());                         }                     }                     return ms.toarray();                 }             }         }     } }