# Securely start a client server connection without ssl/tls [closed]

### NOTE: Pardon my ignorance of encryption, I learned about these concepts today

Going to rephrase this question, but I think I already have fine answers provided. I need to have a block of data containing a message (user imputed) that is included in what I want to encrypt. I also need to have some means of authenticating the user, such as a password. The password will most likely be hashed for extra security. I am considering using a RSA public and private key pair of which the attacker can know, but wont be able to use, as he/she will need to authenticate themselves with a password of which they cannot know. Both the message (which I do not want the attacker to know) and the hashed password will be included inside the RSA encrypted data block (aka: RSA('message block', sha256('password')) ). Right now, my main question is if this is secure or not.

• What is it that the server [knows or [can do]] that the attacker [[doesn't know] or [can't do]]? $\:$ What is it that the client [knows or [can do]] that the attacker [[doesn't know] or [can't do]]? $\;\;\;\;$
– user991
Jun 16, 2015 at 0:28

SHA256 ( SHA256 ( data_before_encryption ) + secret )