Cookie encryption?

>The connection is ssl encrypted and I need to write some sensitive
>information in a cookie. I'd like to encrypt the cookie on the client so
>it could be decrypted later on the server.

The connection is ssl encrypted and I need to write some sensitive
information in a cookie. I'd like to encrypt the cookie on the client so
it could be decrypted later on the server.

1. If I use a symmetric algorithm how do I send the encryption key?

2. Is there any asymmetric algorithm that doesn't have an impact on
performance?

3. Is there a difference in writing cookies with http an https?
I think https in that case doesn't help.

In article <g990ds$1e5$2@news.metronet.hr>, Walter Sobchak
<genijalac@yahoo.comwrote:

>
Consider that doing so exposes your encryption algorithm, including
the encryption key, to anyone with the wit to click View Source.
>
Does this seem like a good plan?

The connection is ssl encrypted and I need to write some sensitive
information in a cookie. I'd like to encrypt the cookie on the client so
it could be decrypted later on the server.
>
1. If I use a symmetric algorithm how do I send the encryption key?
2. Is there any asymmetric algorithm that doesn't have an impact on
performance?
3. Is there a difference in writing cookies with http an https?
I think https in that case doesn't help.
>
Thanks in advance for any suggestions.

Walter Sobchak wrote:
>>
I would usually not perform such a task at the client. The server
could both encrypt the value and set the cookie via a HTTP-header
(still better than document.cookie IMHO).
>>
If you would use javascript, there is no other choice than making the
key/salt available as plaintext for the script in the web page; thus
making it interceptable for the viewer of the page. I think there can
be little doubt that a server-side solution would be better in this
case.
>>
Encryption is memory-intensive by nature; but I wouldn't care much
about only one en-/decrypt action. The difficuly for asymmetric
cryptography is that there are both the private key (encrypt) and the
public key (decrypt).
>
A somewhat safe strategy could be to make only the public key
available to the client; so he can only decrypt the cookie with it.
But I believe this would be the opposite of your plan: when you want
to encrypt asymmetrically in javascript, you always need the private
key.
>
But I think that symmetric cryptography is more recommended in your
scenario (and preferably done at the server).
>>
HTTPS secures the transmission of data along the line, but nothing
more. You are only reasonably safe that nobody can intercept data
between server and client. Most security problems do not relate to
this area.
>
--
Bart

i think it'd be prudent to change your approach on this one, since
you're running into a fundamental roadblock: you want to put secure
info somewhere that's inherently insecure.
>
personally, i'd just write the data to the server and associate it
with that user's account. if there isn't a logged-in user involved in
this operation then... well... what sensitive information could/would
you give to someone you haven't authenticated?
>
-micah
>
>
>
On Aug 29, 7:17 am, Walter Sobchak <genija...@yahoo.comwrote:>

...
The thing is that I have the information on the client side. So I want
to encrypt it and out it in a cookie.
I know that should be done on the server side but I don't know how.

Is there a way to call a server function from a client in a way that you
send a parameter to that function and receive the result??