Need better model to implement this scenario

[JJ]

I have a list of contacts in a webpage and the list is created throught the
repeater controls. During ItemDataBound event of the repeater, I encrypt
the ID of the contacts. When user double clicks on the contact, encrypted
ID of the doubled-clicked contact is sent as a querystring (no postback,
thru javascript) to the detailed page (so that users cannot type in plain
text id and have access to contacts that they are not entitled to), where I
decrpyt the ID and send it to the database and retrieve detailed information
about the contact.

Everytime the user loads that page, encryption is need to encrypt the ID (if
there are 40 contacts, that means 40 different encryptions). I know that
encryption/decryption is resource intensive operations. So I am trying to
find a better model. One option would be to store encrypted ID at the time
I insert a new contact into the database. That way the number of
encryptions is reduced.

What would be the efficient way to implement this scenario. I am open to
any comments/suggestions.

Thanks all

 

[Random]

If your only concern is that you don't have a predicable ID the user can
modify in the QueryString, you can get around the expense of the strong
encryption and just create a weak encryption system of your own. An
encryption algorithm is just an operation to scramble/unscramble a value to
make it unreadable/readable. If no one knows your algorithm, you're good to
go. Of course, if someone is really determined, they can analyze the
multitude of values they know DO get results and try to figure out your
algorithm. You have to decide how much security you really need, in the
end.

Instead of encrypting the values, you could instead just add security onto
the page that displays the contact details.