I'm working on corporate API, that is available for corporate services, where MITM can have terrible consequences.
We decided to use HTTPs instead of HTTP, but after googling i understood that SSL only is not enough.
As i understand, there are two main vulnerabilities while using SSL: 1) There are many CA provider companies now, so nobody is protected from MITM attack, where normal certificate is used by crackers (i found some articles, where it was said that VeriSign had secret department, that was providing secret services for MITM, when VeriSign was the only CA worldwide) 2) Most MITM attacks are possible while using ARP Cache Poisoning
So, i can see only one solution for a moment but not sure if it is a best practice: As API is internal, i can use following things: 1) Encrypt data with symmetric encryption algorythm 2) Limit ips, that are able to use API (as in application, as in server firewall)
Is this enough? maybe there are other best-practices to make really secure connection, that will make MITM impossible?
If this solution (SSL + symmetric encryption algorythm) is ok, could you please advice most suitable encryption algorithms for this kind of issue?
Thanks in advance, will be glad for any help/advices.
UPD: VPN (adviced by frenchie) is not suitable in this context
UPD2: Public-Private key (RSA-alike) is possible (thx 2 Craigy), but very expensive on server side.