title: Alternative to SSL - "Manual" Encryption?
body: <p>I would like to encrypt data that travels back and forth between the server and client in my Web application. I would use SSL but that requires a certificate along with a dedicated IP address. I have no problem getting a certificate but the dedicated IP requires me to upgrade to a business hosting plan which is $20 a month on my Web host. I have no plans on doing that as I'm sticking with my $20/year shared hosting plan.</p>
  <p>So, I would like to implement an alternative to SSL. It does more than SSL does, though. Along with encrypting the data sent back and forth, it also encrypts the rows in the database. I was thinking of doing something like this:</p>
  <p><em><strong>JavaScript Code:</strong></em></p>
  <pre><code>var transfer_key = 'whatever'; 
  function encrypt(data, key) {...}
  function decrypt(data, key) {...}
  
  function send_data_to_server(url, data)
  {
      $.post(url, {'data' : encrypt(data, transfer_key) }, function(response) {
          var decrypted_response = JSON.parse(decrypt(response));
      });
  }
  </code></pre>
  <p><em><strong>PHP Code:</strong></em></p>
  <pre><code>$data = $_POST['data']; 
  $transfer_key = 'whatever'; 
  $storage_key = 'whatever2'; 
  
  function encrypt($data, $key) {...}
  function decrypt($data, $key) {...}
  
  databaseQuery('INSERT INTO table VALUES (?)', encrypt($data, $storage_key)); 
  
  $decrypted_data = decrypt($data, $transfer_key); 
  $response = processData($decrypted_data); 
  
  echo encrypt($transfer_key, $response); 
  </code></pre>
  <p>As you can see, the data the client sends to the server is encrypted, and vice versa. And the data in the database is encrypted as well. Now of course, I would never implement the keys like that. I would probably have a second or third key that's randomly generated for each user. So <code>transfer_key</code> could be equal to a <code>constant_key</code> concatenated with a random key, and same goes for <code>storage_key</code>.</p>
  <p>Would this be a good alternative to SSL?<br />
  How can I implement this type of encryption in such a way that it is harder to defeat? Are there any particular weaknesses to this approach?</p>
  <p>I'm probably going to find a JavaScript library that takes care of the encryption and use PHP's mcrypt extension for the server-side. I was thinking of Blowfish, maybe AES256, but I'm not sure which one gives me the best ratio of encryption strength to memory consumption.</p>
  <p>Advice?</p>