Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

There is encrypted data in the database (asymmetric FYI). It is to be viewed as decrypted on the website. The data can be sent to the client as encrypted to be decrypted on the client's computer, or the data can be decrypted on the server and then sent to the client in plain text.

Now it occurs to me that I don't want anything to be sent from the server to the client as unencrypted. The data needs to be transmitted as encrypted and decrypted on the client side.

If the server is sending encrypted data, a key needs to be sent with it. How does sending a key with the encrypted data not completely defeat the purpose of encrypting it in the first place?

share|improve this question
add comment

2 Answers

Sending the private key along with the encrypted data is the same as having no encryption at all, as anyone monitoring the traffic would be able to decrypt the data.

However, if the client has its own private/public key pair and tells the server its public key, then the server can encrypt data just for that client -- this is the entire point of asymmetric cryptography. The way SSL/TLS works is essentially doing this on the fly: when a client connects to a server, they work out keys to do asymmetric encryption.

My personal recommendation is to just use TLS for securing the client<->server communication rather than essentially roll your own protocol.

share|improve this answer
add comment

It does defeat the encryption. If you want to send encrypted data, use SSL to encrypt the transportation.

If the client needs to display decrypted data and you send the data to the client encrypted, then you can't send the key. This can only mean that you would have some kind of JavaScript code that lets the user enter the private key to decrypt it. In this case the key should never reach your server, because it always remains on the client. But I would not do this, because as user, I would not enter my private key into any web application, because that bears the risk of being sent to the server.

So no, you cannot transfer encrypted data to the client and let the client decrypt it. You need a different concept.

share|improve this answer
    
Thank you. Yes I can encrypt data and send it and have the client decrypt it, and also without SSL. Storing one half a key pair per user on the server. Thank you Darius also. –  user28067 Jul 8 '13 at 23:29
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.