Encrypt user password with jquery and decrypt it with C#

Question

• I don't want to use SSL to encrypt signup and signin forms for a website I'm building.
• I don't have money to pay for a certificate.
• I need to use encryption with jQuery and decryption with C# in my asp.net website.

Does someone have an example and how is it secure to adopt this method?

Answer 1

If you're not using SSL, then you're not secure, but that's not the only reason.

SSL protects the actual communication, whereas encryption protects the data you are communicating. You should not even be encrypting the passwords at all. You should be making a hardened hash of the information. A hash is a one-way function (cannot be reversed), whereas encryption is two-way function(can be reversed). Hash hardening and use includes:

• Iterating over a hash built for speed, such as SHA512 a couple of thousand times or using something like BCrypt.
• Use a salt - Something like a 64-bit array of jumble per user, stored in the database will do it
• Encrypt the keys and salts in the DB using a key in the application layer - This means if your database is taken, they would still need the key from the application layer to access the raw hash information, as well as the salts.

You have to remember that security is built in layers. By skipping SSL, you're skipping a large portion of it. At the very least you can use makecert to create a self-signed certificate. All that will happen is that the user will be warned about it. A good SSL certificate can cost as little as $12.99 on GoDaddy. I recommend getting one as well as implementing the above.

Answer 2

You can do SSL without paying for a certificate, and this method get you secure only browser get information about your certificate is not qualified.

Read about this http://www.akadia.com/services/ssh_test_certificate.html

Answer 3

It's probably not secure at all. SSL really is the way to go; if you can't afford a certificate, you can always make your own. Obviously those won't validate up to one of the trusted root authorities, but they are just as secure - the identity of your website will not be confirmed by a trusted third party, but the connection itself will be just as securely encrypted.