I have a web based application for a network that needs to be able to run without internet access. I have wanted to add TLS to protect certain data in transport. I have explored options like Lets Encrypt and OpenSSL but neither seem truly viable for my situation. Lets Encrypt requires internet access and OpenSSL requires you to add an additional trusted CA to client machines. For many of the environments this app could run, robust TLS may be overkill but I would still like to protect some information in transport. I had an idea to accomplish this. I am hoping those here can explain why this solution may not be recommended and if an existing solution may be more desirable.
So lets say I have a login form where TLS is not available. To prevent a valid user's credentials from being observable when sent to the server I would do the following:
- When serving the page first generate a high entropy random token and relate this token to the un-validated session ID.
- When the user submits their credentials, first encrypt the values on the client using the token as a key.
- When the credentials arrive at the server the server will find the associated key for this session ID.
- Once we have a possible key we will then decrypt the login credential and test against those that are valid.
- Whether this login is successful or not, if this key is valid it will be destroyed.
- A successful login will destroy the key and generate a new session ID while invalidating the previous ID.
Please explain to me why this solution may not be recommended and some possible weak points. DOS attacks are not of large concern.