CODEWITHSUNDEEP
asp.netalgorithmencryptionwebchat
Rasool Ahmed
Rasool Ahmed

Reputation: 185

Secure Web Chat in C# ASP.NET Core 2

First, I'm working on a Master student's project, the project is a Web Bank System and apply encryption algorithms on this system.

The first algorithm which is a new encryption algorithm designed by the student who requested my help is to encrypt the sensitive data (Credit Cards information) on the database.

The second algorithm (which is a modified AES algorithm) is to encrypt the messages between the customer of the bank and the admin of the bank system using a web chat room.

Of course, there is no problem with the first algorithm because I can apply it to encrypt the Credit Card information submitted by the user and save it on the database.

But, the problem is that the professor that supervising on this student project insisted to secure the messages sent across the network by the admin and customer that they are using the web chat room and these messages must be secured using the second algorithm (modified AES).

As you all know, if I just code the second algorithm in Javascript to encrypt the messages on the browser client machine then send those encrypted messages to the server, that means this algorithm will be available to anyone who opens this webpage because we all know that Javascript is an open client source.

So, no more talking, I just want to ask that:

How to apply any encryption algorithm to secure the data transfer between client machine and server machine by using web application (for example web chat application) without to be this algorithm an open source to any client machine?

Upvotes: 2

Views: 679

Answers (2)

Jeffrey Rennie
Jeffrey Rennie

Reputation: 3443

ADyson's comment contains the best solution to solve this problem practically, but it sounds like the professor has added constraints that prevent you from employing a practical solution.

It is not possible to execute an encryption algorithm on a client machine and at the same time keep the encryption algorithm a secret from the person and machine running the algorithm. They can always inspect the code.

Upvotes: 2

CoffeeEqualsCode
CoffeeEqualsCode

Reputation: 11

As far as I am aware this is not possible, because the client will have to be able to both encrypt and decrypt messages; it logically requires the client understanding the encryption algorithm.

The strength of an encryption mechanism comes from the difficulty of reversing an encrypted message to plaintext without the key, even if one knows the algorithm.

If knowing an encryption algorithm allows someone to decipher a message without the key, then the algorithm is weak.

Upvotes: 0

Related Questions