Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know that we have HTTPS, but I would like to know if there's an algorithm/approach/strategy that grants a reasonable security level without using SSL.

I have read many solution on the internet.

Most of them are based on adding some time metadata to the hashes, but it needs that both server and client has the time set equal. Moreover, it seems to me that none of this solution could prevent a man in the middle attack.

share|improve this question
up vote 1 down vote accepted

If you really wanted to, you could implement the same asymmetric encryption from within the browser (assuming Javascript, of course):

You give one key to the user, and keep one key for yourself. Even if someone intercepts the key the client has, they won't be able to decrypt the information the client has sent back to the server. Note: anyone who intercepts the key the user has will be able to decrypt whatever the server sends to the client - so either you need to work around this (e.g. get the client to generate a new key pair, and send you one or just make sure you never send anything sensitive back). You need to be careful with generating these key pairs, if they're at all predictable, they're as good as no security at all.

To know why this works, check out its Wikipedia page.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.