how to implement public and private key

[achilles91]

Hi everyone

Let say,
I have a pair of generated private key and public key (hard coded and never change)
Every time user visit my page, my page will send the public key to particular user.
When user login account, the user will make encryption by public key and send to my server.
My server will use the private key to decryption and do validation.

Problem :
1. After I send the public key to user, where should the public key store at client-side ? SESSION or COOKIE ? (can give some example code ?)

2. How to make the Client-side encryption happen ? (because i need encrypt the data before send to server, not after sent to server) Does the encryption perform by client-browser ? How to tell the browser do the encryption and use which encryption standard algorithm that my server using. (can give some example code?)

I'm avoiding SSL, this project is my college final year project, I'm not gonna pay for the SSL

[ejsexton82]

I don't know about public and private keys, but you can always create a self-signed SSL certificate for free. There are several articles on how to do it, along with tools which make the process fairly simple.

The only downside is that since you signed the certificate yourself, and you are not a Certificate Authority (CA), browsers will give you certificate errors, but there are ways to deal with that.

On a side note, you can go to CheapSSLs.com and buy a basic SSL certificate for the price of a six-pack of beer.

[ventchris]

Hi, just want to check did your encryption on client-side means something like encrypting the password so that when its stored in the database its encrypted?

if so, this is my example:
$query = "SELECT * FROM users WHERE username ='$username1' AND password = SHA1('$password')";
this is for extracting out hashed data from the server
for encryption its:
$query = "INSERT INTO users(username,password,)VALUES(null, '$username1', SHA1('$password')";
so what basically this does is that, it encrypts the data first then stores it in the database, when extracting, the client-side hashes the data input, and checks with the database extracting the field where it matches the hash.

Hope this is what you need if not feel free to reply and i will try to help you.