There is encrypted data in the database (asymmetric FYI). It is to be viewed as decrypted on the website. The data can be sent to the client as encrypted to be decrypted on the client's computer, or the data can be decrypted on the server and then sent to the client in plain text.

Now it occurs to me that I don't want anything to be sent from the server to the client as unencrypted. The data needs to be transmitted as encrypted and decrypted on the client side.

If the server is sending encrypted data, a key needs to be sent with it. How does sending a key with the encrypted data not completely defeat the purpose of encrypting it in the first place?


Sending the private key along with the encrypted data is the same as having no encryption at all, as anyone monitoring the traffic would be able to decrypt the data.

However, if the client has its own private/public key pair and tells the server its public key, then the server can encrypt data just for that client -- this is the entire point of asymmetric cryptography. The way SSL/TLS works is essentially doing this on the fly: when a client connects to a server, they work out keys to do asymmetric encryption.

My personal recommendation is to just use TLS for securing the client<->server communication rather than essentially roll your own protocol.

| improve this answer | |

It does defeat the encryption. If you want to send encrypted data, use SSL to encrypt the transportation.

If the client needs to display decrypted data and you send the data to the client encrypted, then you can't send the key. This can only mean that you would have some kind of JavaScript code that lets the user enter the private key to decrypt it. In this case the key should never reach your server, because it always remains on the client. But I would not do this, because as user, I would not enter my private key into any web application, because that bears the risk of being sent to the server.

So no, you cannot transfer encrypted data to the client and let the client decrypt it. You need a different concept.

| improve this answer | |
  • Thank you. Yes I can encrypt data and send it and have the client decrypt it, and also without SSL. Storing one half a key pair per user on the server. Thank you Darius also. – user28067 Jul 8 '13 at 23:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.