/    Sign up×
Community /Pin to ProfileBookmark

Public key encryption between JS and PHP. Completely lost – need help

Hi guys, I am trying to set up a secure login/registration for my website.

My goals are as follows:
Whenever someone wants to log in or register
PHP will generate an RSA key pair
PHP will send the public key to the login form and save the private key in a “login attempts” table in the DB
Javascript will encrypt the username and password using the public key, and then send it back to the server.
PHP will then decrypt using private key in table and check for the username combination in users table and allow/block access in login, or creates a new user in users table when registering.

Some notes:
1) You guys are probably asking me why I’m not using SSL and I’m trying to reinvent the wheel. The reason is i want to control every aspect of the procedure. I want to know all the ins and outs of my system.
2) I know this system is susceptible to man in the middle attacks.

What i need from you guys:
I tried looking for javascript and PHP RSA scripts and found some. However, they are not compatible with one another. I need a complete system that can encrypt in Javascript and decrypt in PHP.

I tried the following:
[URL=”http://www.sematopia.com/2008/10/rsa-encrypting-in-javascript-and-decrypting-in-php/”]http://www.sematopia.com/2008/10/rsa-encrypting-in-javascript-and-decrypting-in-php/[/URL] – Couldn’t get PEAR working properly
[URL=”http://www.jcryption.org/”]http://www.jcryption.org/[/URL] – Too complicated. Couldnt understand how to work it or how it works.
[URL=”http://assl.sullof.com/assl/”]http://assl.sullof.com/assl/[/URL] – Too complicated. Couldnt understand how to work it or how it works.
[URL=”http://phpseclib.sourceforge.net/”]http://phpseclib.sourceforge.net/[/URL] – No matching JS encryption script.
[URL=”http://code.google.com/p/bi2php/”]http://code.google.com/p/bi2php/[/URL] – No matching JS encryption script and cannot generate keys. No documentation.
[URL=”http://www.phpclasses.org/package/4121-PHP-Encrypt-and-decrypt-data-with-RSA-public-keys.html”]http://www.phpclasses.org/package/4121-PHP-Encrypt-and-decrypt-data-with-RSA-public-keys.html[/URL] – No matching JS encryption script and cannot generate keys.
[URL=”http://www.ohdave.com/rsa/”]http://www.ohdave.com/rsa/[/URL] – No matching PHP decryption method.

[SIZE=”5″]I am completely lost right now. Can anyone point me to a tutorial that comprehensively covers what i need[/SIZE] (key generation, encryption in JS and decryption in php)[SIZE=”6″]?[/SIZE]

to post a comment
PHP

18 Comments(s)

Copy linkTweet thisAlerts:
@dellerauthorAug 01.2011 — oh, also tried http://stevish.com/rsa-encryption-in-pure-php - No JS decrypt function to work with it...
Copy linkTweet thisAlerts:
@dellerauthorAug 02.2011 — this must be a record. 125 view and no response...
Copy linkTweet thisAlerts:
@svidgenAug 02.2011 — 1) You guys are probably asking me why I'm not using SSL and I'm trying to reinvent the wheel. The reason is i want to control every aspect of the procedure. I want to know all the ins and outs of my system.[/QUOTE]

Insufficient reason not to use SSL.

If this is a [I]learning[/I] project, start with the fundamentals and write everything from scratch: http://en.wikipedia.org/wiki/RSA

But, if you can help it, don't use your own encryption scheme to protect user credentials. [B]Use SSL.[/B] Unless you're some kind of supergenius ... but I can't imagine you'd be asking for tutorials if you were.
Copy linkTweet thisAlerts:
@dellerauthorAug 02.2011 — This IS a learning project. But i dont know all the math to write an RSA algorithm on my own. I want something i can start with and modify, and after i learn how it works, rewrite it.
Copy linkTweet thisAlerts:
@svidgenAug 02.2011 — Well then, start with the wiki page and refer to the associated wiki pages for all the mathematical concepts you're not familiar with.

Translating the a mathematical formulas into code is the easy part ... wrapping your head around the math (why it works, etc.) is an entirely different story.
Copy linkTweet thisAlerts:
@dellerauthorAug 02.2011 — Well, translating the mathematical formulas into code might be easy for you.

I only took calculus level 2, and i dont understand half the stuff on the wikipedia pages for RSA.

I would learn better if i had a full system to take apart and analyze each part.
Copy linkTweet thisAlerts:
@svidgenAug 02.2011 — It's not calc. It's discrete math. Talk to a discrete math professor ...
Copy linkTweet thisAlerts:
@dellerauthorAug 02.2011 — I know its not calc - hence why i dont understand it.

Im not in university right now, so thats kind of a problem, dont have professor to talk to. I just wanted to mess around with it a bit and understand it a little but from the application side, not the theoretical side, but if there is no js to php implementation, i guess i cant...
Copy linkTweet thisAlerts:
@svidgenAug 02.2011 — Well ... or a CS professor. Any CS prof you talk to will have to know a good deal of discrete math. And they'll know how to translate the math into code. But, in short ... you can probably get away with using the built-in math functions in most languages for learning purposes:

multiplication: *

modulo (mod): numerator % divisor

JavaScript exponentiation: Math.pow(base, exponent)

PHP exponentiation: pow(base, exponent)

If you want to start working with "real" scenarios, you need to start using (or writing) libraries that can do the math on values that don't fit into 32 bits and/or use "shortcuts" to allow you to compute complex equations without overflowing your ... erm ... "computation space."
Copy linkTweet thisAlerts:
@svidgenAug 02.2011 — I know its not calc - hence why i dont understand it.

Im not in university right now, so thats kind of a problem, dont have professor to talk to. I just wanted to mess around with it a bit and understand it a little but from the application side, not the theoretical side, but if there is no js to php implementation, i guess i cant...[/QUOTE]


Well, it's not much good to start with the code and try to understand it apart from the math. Most of us just leave the math to the mathematicians. We use functions like:

[CODE]c = encrypt(m, public_key);
m = decrypt(c, private_key)[/CODE]


... because we know someone else, smarter than us, has taken care of the math. If you want to understand how encrypt() and decrypt(), it's got very little to do with the code. The code is just a detail. And it's all just nonsense unless you understand the math.

If there's a university in your area, just email one of the profs and ask if he's willing to talk. I don't imagine you need to be enrolled to appeal to a prof's sense of generosity ... or w/e.
Copy linkTweet thisAlerts:
@dellerauthorAug 02.2011 — say i wanted to work backwards from that code

which libraries can do
[code=php]c = encrypt(m, public_key);[/code]
in JS

AND
[code=php]m = decrypt(c, private_key);[/code]
in PHP?
Copy linkTweet thisAlerts:
@svidgenAug 02.2011 — Well, you're not going to [I]easily[/I] find an RSA library written in PHP. Folks just use a compiled library, like mcrypt:

http://php.net/manual/en/book.mcrypt.php

And to see that code, you'll have to grab the PHP engine's source and dig through that.

JavaScript? ... I don't know ... when I searched for it I found http://ohdave.com/rsa/

That looks good. But, it's not like you can just call the JavaScript function with the result of your PHP function. You need to establish a communication mechanism of some sort, and you probably need to BASE64 encode/decode your ciphertext.
Copy linkTweet thisAlerts:
@svidgenAug 02.2011 — My advice ... if this is a learning project, just write the JavaScript end. Don't try to write both ends simultaneously. Develop incrementally.

Write a page with some JavaScript that can send receive plaintext messages to/from the server.

Wrap those communications in base64 encode/decode methods.

Attach simplified enryption/decryption algorithms (like using a single-key multiplication/division "encryption"): communicate the keys over base64 before transmitting the secret message.

Incrementally add some complexity to the encryption/decryption routines until you're comfortable writing or understanding the math behind RSA ...
Copy linkTweet thisAlerts:
@dellerauthorAug 02.2011 — sounds like a pretty good idea.

btw, do you know how this could have happened?

when i go to WAMP phpmyadmin it shows

"PhpMyAdmin - Error

Cannot load mysqli extension. Please check your PHP configuration. - Documentation"


I tried reinstalling, restarting and looking for solutions online, but they dont work.
Copy linkTweet thisAlerts:
@svidgenAug 02.2011 — Not sure I can help you there. If you were running a LAMP environment, it could be a matter of recompiling with a mysqli option or seperately installing a mysqli module (like [I]yum install <phpcomponent>[/I] on CentOS). Not sure what you'd have to do in WAMP ...

I'd suggest installing the IIS component and getting MS's PHP installer. You could then add PHP components through the IIS admin interface.
Copy linkTweet thisAlerts:
@grossiniNov 01.2011 — I wrote a paper on your asked solution using RSA - and Jcryption javascript.


You can find it here http://digidownload.libero.it/magiainformatica/login_secure.pdf and

the code http://digidownload.libero.it/magiainformatica/login_crypted.zip.

Hope this can help you
Copy linkTweet thisAlerts:
@grossiniNov 02.2011 — [/QUOTE]
Hello - here is my paper on More Secure Login based on jCryption javascript- RSA

implementation.

The server script is designed as simple as possible and obviously server side

can/must use a db user table crypted password field in real life implementation:

http://digilander.libero.it/magiainformatica/login_secure.pdf.

And here is zipped code of scripts and related library function:

http://digilander.libero.it/magiainformatica/login_crypted.zip

Hope can help.
Copy linkTweet thisAlerts:
@grossiniNov 02.2011 — Hello - here is my paper on More Secure Login based on jCryption javascript- RSA

implementation.

The server script is designed as simple as possible and obviously server side

can/must use a db user table crypted password field in real life implementation

http://digilander.libero.it/magiainformatica/login_secure.pdf.

And here is zipped code of scripts and related library function:

http://digilander.libero.it/magiainformatica/login_crypted.zip

for server side db password checkout many example in web - my preferred is here: http://www.jamesdam.com/ajax_login/login.html#login.

Pay note that password in user table must be entered with md5-function, i used PhpMyadmin.

Hope can help.
×

Success!

Help @deller spread the word by sharing this article on Twitter...

Tweet This
Sign in
Forgot password?
Sign in with TwitchSign in with GithubCreate Account
about: ({
version: 0.1.9 BETA 5.8,
whats_new: community page,
up_next: more Davinci•003 tasks,
coming_soon: events calendar,
social: @webDeveloperHQ
});

legal: ({
terms: of use,
privacy: policy
});
changelog: (
version: 0.1.9,
notes: added community page

version: 0.1.8,
notes: added Davinci•003

version: 0.1.7,
notes: upvote answers to bounties

version: 0.1.6,
notes: article editor refresh
)...
recent_tips: (
tipper: @AriseFacilitySolutions09,
tipped: article
amount: 1000 SATS,

tipper: @Yussuf4331,
tipped: article
amount: 1000 SATS,

tipper: @darkwebsites540,
tipped: article
amount: 10 SATS,
)...