RE: Cryptography and Site Security: Please critique my security idea

Obviously this is a vendor-specific solution on the server side, but what if you used IIS and w2k or .NET server with encrypting file system, and either SSL client certificates (optionally in one of those cool USB hardware tokens) or else at least using HTTP authentication. Now the attacker won't be able to download the encrypted files unless they compromise a user account. And there's no weirdness with file "1" that contains everybody's keys.

I may be wrong, but it sounds like you're reinventing the wheel...

Phil

> -----Original Message-----
Received on Thu Mar 27 22:41:32 2003