AppEngine and Encryption

One of the more requested features of the AppEngine is SSL support. While I have no doubt that this will get resolved over time, I wonder if there aren't ways to make data secure even in the current version? At least in the Web 2.0 ages, I believe there might be.

Imagine we start building a new web app from scratch. Most static pieces of the application do not really require encryption (html, company logo, css...). Let us also assume that we are not afraid of Javascript and can exchange all sensitive information through XmlHttpRequests. What prevents us from encrypting that data before sending it out? All we need is for client and server to negotiate an encryption method.

Ingredients needed:

• a pure python implementation of RSA
• a pure javascript implementation of RSA
  
• Javascript and Python implementations of AES

(I have not tested any of these components, so there might be better ones out there).

Imagine the server runs on AppEngine and that we uploaded a key of public/private keys with the app. What would prevent us from doing the following:

• put the public key into one of the Javascript files that is downloaded as part of the application. This way, the Javascript client is able to encrypt data in a way only the server can read.
• upon initialization, the Javascript client creates a random key for AES encryption. It encrypts that data using the public key and stores it in a cookie.
• we create out own version of an XmlHttpRequest that encrypts all data before sending it out using AES
• the server gets the encrypted data, extracts the key from the encrypted cookie, and uses it to decrypt the data
• when the server needs to send any data in return, it uses the very key it got from the client to encrypt the response

I have not tried this, so have no idea what impact this would have on my quota (encyrption/decryption in pure python might be expensive). I also do not know how performant AES would be on the client side. I currently have no need for that kind of security in my apps, so it's not worth the effort finding out. Still, if anyone else happens to have played with it, let me know :-)