TCP Security

[Mike Hildner]

I have an app that uses sockets to send and receive criminal information, like when a cop pulls you over and runs your license plate.

For production, I need this to be secure (good enough for the FBI). Is there an easy way to do this given my current setup? Would I be better off changing to a web service and access via HTTPS?

Any thoughts are appreciated,
Mike

[nemaroller]

No matter how you do it, whether over sockets (including port 80), through VPN, whatever....
your last line of defense is the encryption.

SSL is probably a good idea, however, I would go as far as encrypting the data more yourself, using the .Net cryptography classes.

http://www.devx.com/security/Article/7019/

[Mike Hildner]

Thanks, nemaroller. I searched all over google and verisign without even thinking of MSDN, didn't even know .NET had cryptography classes. Duh.

In particular, I must do this:

FIPS Standard 197, Advanced Encryption Standard (AES)...At least a 128 bit key must be employed.

Quick look says I can.

Thanks again,
Mike

[nemaroller]

Well, I know about them because up until 3 months ago, we were developing police software, but now focus just on security software for private corporations and casinos.

The reason had to do with the requirements police departments necessitate to even consider for bids, are too big for our small company, what with GPS systems tied to dispatches, UCR AND NIBRS reporting, disconnected data, the third-party vendors software we would need to incorporate to offer accounting services on top, jailing packages, human resources administration.... it kept ballooning, and just became a logistical nightmare, and one we decided wasn't worth the bids.

[Mike Hildner]

Interesting. I work for a small company as well, but cop software is all they've done for 20+ years. In that time, a vast amount of code has been written.