<p>Hey everyone, I am researching a project where we would need to keep a value encrypted from the client all the way to a black box system without decrypting it at any point in between.  We are using SSL between the browser and web server, but the values are automatically decrypted at the web server, which is what we need to keep from happening.  We need to be able to pass it through the web server (still encrypted) and through other back end systems until it hits its final destination where it would be decrypted.  </p>

<p>So my question is what options are available to us for maintaining an encrypted state for a value from the browser back, without decrypting it anywhere along the way?</p>

<p>Thanks
Mark</p>

you'll want to take a look at
public key encryption
. SSL protects your session (browser <-> server) but not the full transport. i'd suggest encrypting your data once it's received from the client, then sending the encrypted data all the way in.
here's a terrible diagram outlining the flow of data
```
```
client browser    web server       random server       blackbox
route   ---- SSL -------------><------------- not encrypted ------->
data                          *-------- PGP/GPG encrypted --------->
```
```
basically your data is encrypted via SSL to the web server, where it is PGP/GPG encrypted, then sent downstream. SSL doesn't matter at this point (or at least, isn't the primary form of encryption).
unless you can guarantee javascript in your environment, it may be better to encrypt at the web server to make sure your data is secure if the user has javascript off for some reason.