13

Is there any javascript function that can encrypt data: For example i want to use encrypted data in my URL passed by ajax GET request,

http://sample.com/mypage/TDjsavbuydksabjcbhgy

where TDjsavbuydksabjcbhgy an encrypted data equivalent to 12345. Now i want to retrieve that data in PHP by decrypting it, so that i can use the 12345.

Is it possible? or any suggestion on how to do that.

Thanks in advance.

Improve this question
3
  • 2
    Any reason you can't use a secure server for the ajax? Commented Mar 10, 2010 at 2:13
  • What attack are you trying to defend against? Commented Mar 10, 2010 at 2:16
  • 1
    Please tell us why you want to encrypt it. It's certainly possible to do it, but it may not be sensible or there may be other, better solutions for the problem you're trying to solve. Commented Mar 10, 2010 at 2:16

5 Answers 5

Reset to default
10

I'm not sure what you would gain by doing encryption in javascript. Your entire routine and encryption key are effectively available to the public. If you are trying to protect against sniffing, you should use SSL.

Improve this answer
Sign up to request clarification or add additional context in comments.

8 Comments

Using SSL is not enough. The server can record requests after SSL decryption, SSL can be provided by a reverse proxy, certificates can leak or be stolen, etc. And we can have bugs like Heartbleed. For better security, Javascript encryption can actually reduce exposure.
@fernacolo - Good encryption is entirely about key management and key exchange. So, if you are not using SSL (specifically some variation of TLS) nor some equivalent method to get the encryption keys to the client, you are rolling your own which is many orders of magnitude less secure.
@Thomas I never told to not use TLS. It's a must-have requirement, but it's not enough. For instance, if login requests with cleartext passwords are logged forever in backend server, a future attacker who has access to logs will get many passwords. To fix this, you can simply generate a new soft RSA key pair for every login form request, keep the private key in session memory, and encrypt in the client with the public key. No key management is actually necessary and the public key doesn't need special key exchange. An attacker have to access session data, which is stale an often not logged.
@fernacolo - but it's not enough. Enough for what risk profile? A future attacker good enough to crack TLS and/or access to your server can crack your encryption. a future attacker who has access to logs. That depends entirely on what is being logged. Don't log the payload of the web requests.
@fernacolo - RSA key pair for every login.... You should post this suggestion on security.stackexchange.com and see what they say. My guess is that they will tell you a host of ways that this can be cracked such as stale keys, weak encryption, man-in-the-middle etc or that it is no better than current TLS. At the end of the day, it all depends on what risk you are specifically trying to mitigate.
|
5

You could use AES + Base64, there's a JS aes library at http://www.movable-type.co.uk/scripts/aes.html, should be doable in php as well http://www.movable-type.co.uk/scripts/aes-php.html.

Improve this answer

2 Comments

Okay, so where are you going to put the key so the attacker can't find it?
The key could be a shared secret, for example based on the user password and stored in a way it never goes 'over the line' (there are ways for js client-side storage). SSL might be more secure though.
5

What you are probably looking for is RSA encryption. You generate a key for your server to use which has a public version and a private version. Your javascript will contain the public version which can be used to encrypt the data, and your php will use the private version to decrypt the data.

As a jumping off point, you can start here for javascript public/private key examples: http://shop-js.sourceforge.net/crypto2.htm

And here for the PHP side: http://www.webtatic.com/blog/2009/07/php-public-key-cryptography/

Improve this answer

Comments

3

I think you will have to use SSL to encrypt everything.

Improve this answer

Comments

2

I found (Bridge between server and client) is the perfect way. the server-side encrypting and decrypting using php is not the matter. but client side and javascript encrypting means no Security because your code, encryption key, alghoritm and all is available for public users. (I found this answer and SSL use as described above). Finally i encrypt both client and serverside with a trick. you can load you random encryption key first of php script and use it in your jquery and so every user have many keys per request which will be usefull for same request. every session encrypted afterwards it's a unusable key. For Maximum Security you can extend this idea (Because of some security purpose I can't describe more but Solved this way.) Example: index.php

 <?php

 $curl = curl_init();
 $url='http://some.xyz/keygen.php';
 ###we set url in a var to insure that anyone can't change it way.
 curl_setopt($curl, CURLOPT_URL, $url);
 curl_setopt($curl, CURLOPT_POST, true);        
 curl_setopt($curl, CURLOPT_POSTFIELDS, $data);
  $reply=curl_exec($curl);
 //$reply-< session key is generated in another page and replied to this
  //ex :15984762255sadasf4a5sfd5asfda745
 ?>

Client-side(same index.php page)-using forge or cryptojs for encrypting: we echo random generated recieved key for encryption by php in jquery script and do this for all inputs of form.**

<script>
     $('#form').find('input').each(function(){      
    rsa.keypair = keypair;
     var pemPublic = forge.pki.publicKeyToPem(<?php echo($reply); ?>,
   encoded=rsa.keypair.publicKey.encrypt($("#cleartext").val()),
    final = forge.util.encode64(encoded);
   </script>

Send Final by ajax and decrypt server side by php. Don't forget You Keep Private key for decryption in database or any safe place for decryption. Notice : You must do many shortcuts like this to achieve 100% secuirty. Hope To Be Helpful.

Improve this answer

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.