I need to make a request to a web server, the only information I have from the member is an account number and password. The account number can’t be encrypted because I need that information to look up the members record. I would like to encrypt the password before passing it to the web server. But I don’t have any secret key to encrypted the member password, the application can be reversed engineered. My question is can you encrypt a password using that password?? Like MySecretKey is encrypted using MySecretKey as the password. I don’t know if this is possible even if salt is added. Any advice?
marked as duplicate by this.josh, Scott Pack, dr jimbob, Jeff Ferland♦ Aug 29 '12 at 18:49
This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.
To answer your specific question, then yes, of course, you can encrypt a piece of data using another piece of data as key, even if both the data and the key happen to be identical. But what would that achieve ? Decrypting would be difficult: you need the key to decrypt, and you do not have the password until you have decrypted it...
"Self-encryption" could be viewed as a kind of hash function: a deterministic transform of some input data, in a way which can be reversed. Hashing is the proper framework for password storage (where, in fact, the password is not stored, only a password verification token). However, growing home-made hash functions is known to be hard; when cryptographers want to build a hash function, they take a lot of time because they need to be sure that the function is secure, and you cannot know that just by looking at it.
Also, secure hashing is not, by itself, sufficient. You need a SLOW and SALTED hash. This subject has been beaten to death several times on this site, see for instance this question or that one. The comprehensive answer being: use bcrypt.
I think this is what your question is really about. Use SSL. Don't roll you own method of trying to permute the password. If it's encrypted in transit with SSL and compared to a hashed version (preferably something suitable for passwords like bcrypt as Tom Leek pointed out), then you've got the best practices setup.