One of my clients wants to encrypt few sensitive information which will be transferred through webservices / SOAP.
My client has the following suggestions:
- Encrypt the sensitive data with AES 128-bit using CTR and Padding.
- Each time unique key will be generated which will be passed along with original information.
My view is, what's the real use if you are already sharing the Key in Message, any one can decrypt the message using key (am I missing anything?). Any ideas, what should I suggest for them in such scenario for better and secure communication?
It's not related to any login info. But this is still important info that should be secured as much as possible with minimum impact on overall.