Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I know that we have HTTPS, but I would like to know if there's an algorithm/approach/strategy that grants a reasonable security level without using SSL.

I have read many solution on the internet.

Most of them are based on adding some time metadata to the hashes, but it needs that both server and client has the time set equal. Moreover, it seems to me that none of this solution could prevent a man in the middle attack.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

If you really wanted to, you could implement the same asymmetric encryption from within the browser (assuming Javascript, of course):

https://www.pidder.com/pidcrypt/?page=demo_rsa-encryption

You give one key to the user, and keep one key for yourself. Even if someone intercepts the key the client has, they won't be able to decrypt the information the client has sent back to the server. Note: anyone who intercepts the key the user has will be able to decrypt whatever the server sends to the client - so either you need to work around this (e.g. get the client to generate a new key pair, and send you one or just make sure you never send anything sensitive back). You need to be careful with generating these key pairs, if they're at all predictable, they're as good as no security at all.

To know why this works, check out its Wikipedia page.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.