assuming that I have a page named: messages.php which is a real-time chat system.
- first when the page loads, a page id is generated and then an Encryption Key is stored into a Session called
$_session["key".page_id]. using page_id makes it possible to use a unique encryption key for each opened "messages.php" page in the browser. the encryption key and the page id are also echoed to the page in this way:
var key = [generated_key_stored_in_session]and
var page_id = [generated_page_id].
- when the user sends a message, it is first encrypted using AES with the variable
keyas the encryption key. after encryption, the encrypted message and the page_id variable will be sent to the server with POST method using Ajax.
- Now the server receives the data and loads encryption key from Session using the received page_id. and the received message will be decrypted and stored to the database.
- And now the server generates a new key sets a
$_session["key".page_id]with that and then echoes the new encryption key which will be received by Ajax and be used for further encryption.
I think that this method is not safe because the encryption key is transferred as text and it's possible to read that with traffic monitor tools.
What is the best way to send the key? and how can I implement Public Key/Private Key system here?