We are working on a school project that handles sensitive information (a password manager) that transit between a client which encrypt the data and a server which knows nothing about the data. In order to get the data, the client needs to authenticate through a username/password then gets a randomly generated token.
It will be a self hosted app, and our goal is to have something secure even if the user do not bother use HTTPS. So we want to make sure that if someone snooped the token, he would not be able to use it.
We thought that we could use a signed message through OpenPGP but this means that every message needs to be different, and older data need to be stored server-side so that replay attack can't be used.
This idea is clearly not the best. Does anyone have a better one?