> My client has a website that has a secure login process running under
> SSL. When a user has succesfully logged into that website they will
[quoted text clipped - 10 lines]
> this would mean that both the client and I would need to share
> envyption keys.
What you're looking for is commonly known as "Single Sign-On", or SSO.
It's usually securely implemented by using a piece of data in the query that
contains the ID, a "nonce" (a random number), or timestamp, and a signature
of this set of data. That data-set allows you to ensure that the ID was
verified by a server that you trust (that's the signature part), and that it
wasn't copied over from some previous query (that's why you have the server
sign the ID _and_ the nonce).
A search for "SSO" or "Single Sign-on" should give you more details, and may
provide you with links to standard solutions, or readily-available
third-party implementations. Generally, you do not want to write your own
cryptographic components!
Alun.
~~~~
[Please don't email posters, if a Usenet response is appropriate.]

Signature
Texas Imperial Software | Find us at http://www.wftpd.com or email
23921 57th Ave SE | alun@wftpd.com.
Washington WA 98072-8661 | WFTPD, WFTPD Pro are Windows FTP servers.
Fax/Voice +1(425)807-1787 | Try our NEW client software, WFTPD Explorer.