title: What encryption procedure I must use to send encrypted 'email' and 'password' values over the HTTP protocol?
body: <p>I am using Ruby on Rails 3 and I would like to send 'email' and 'password' values (I know, I should not, but I need that) over the HTTP protocol. I need to send user credentials from a <em>my client</em> application to a <em>my service</em> application*.</p>
  
  <p>I can use a public a private <em>RSA</em> key to accomplish that but, if so, I must don't send the public key to the recipient over HTTP, otherwise an hacker can steal the key and decrypt contents. On other hands, the HMAC encryption (if I understood that) is good only to verify the data integrity and the authenticity of a message.</p>
  
  <p>I heard of <strong><em>AES</em></strong>... <strong>is it good for my purposes? If so, where I can find a tutorial on how to use that with Ruby\Ruby on Rails?</strong> I "simply" need to encrypt user credentials on the client side and decrypt that on the server side.</p>
  
  <p>P.S. I: If I'm wrong about something I wrote, let me know.</p>
  
  <p>P.S. II: If you suggest other methods, let me know!</p>
  
  <hr>
  
  <p><strong>UPDATE I</strong></p>
  
  <p>*The client is a web application (a site web, for example 'www.site1.com), the server is another web application (another site web, for example 'www.site2.com).</p>
  
  <hr>
  
  <p><strong>UPDATE II</strong></p>
  
  <p><em>Using RSA encryption...</em></p>
  
  <p>Client-I-service steps:</p>
  
  <ol>
  <li><p>Client generates public\private key paris</p></li>
  <li><p>I (a real person) copy-paste manually the public key from the client to the service</p></li>
  <li><p>Client sends to the service the message including encrypted user credential (client doesn't send\append the public key to the HTTP request)</p></li>
  <li><p>Service, using the public key (that only the service knows), decrypts user credentials and proceed to the login of the user</p></li>
  </ol>
  
  <p>Now, if I send the public key instead of doing the step 2, and so the client must send the public key in step 3 over the HTTP protocoll, an hacker can </p>
  
  <ol>
  <li><p>intercept the message</p></li>
  <li><p>take the public key</p></li>
  <li><p>decrypt the user credentials and steal those</p></li>
  </ol>
  
  <p>So, <em>should I encrypt user credential</em> (those are important and private information) <em>using a RSA encryption if I send the public key to the service</em>?</p>