Re: Joining ASP encryption (ASPEncrypt) and PHP encryption (mcrypt)

From: clem (clem_at_numeral.com)
Date: 05/28/03 

Date: Wed, 28 May 2003 03:31:59 -0700

On 28 May 2003 01:27:40 -0700, kylotan@hotmail.com (Kylotan) wrote:

>We are trying to write server-side code that encrypts and decrypts
>strings using PHP. All well and good, except that our encrypted data
>needs to be read by someone else who is using ASP and their encrypted
>data in ASP needs to be read by us with PHP.
>
>Given the correct use of the standards, this sounds like a trivial
>problem. However, I am no encryption expert and the
>libraries/components that do encryption for us tend to be a little
>opaque.
>
>For instance, we are using the mcrypt library
>(http://mcrypt.hellug.gr/) for PHP, which seems to support a lot of
>algorithms but makes no mention of things such as padding. On the
>other hand, our partners are using ASPEncrypt
>(http://www.aspencrypt.com/) which seems to give more control over
>things such as cipher padding, but obscures details such as how a key
>is created from a password, for instance.
>
>The end result is that what looks like the same key and cipher
>produces different results on our systems, and it's hard to isolate
>what is causing the discrepancy.
>
>Does anybody have any suggestions on methods that will work here, or
>sample code that has worked in the past? We were looking at using
>something like the RC4 algorithm, if that helps. Strength and speed
>are not necessarily as important as simply getting something that
>works consistently for both of us.

Just going to throw out some comments from the first impressions of
reading your post:

Judging from your comments about RC4, it looks like you are opening up
a can of worms. Do you realize the issues involved using RC4 in a
secure fashion? It is harder than it appears.

Will anyone get hurt or lose property if the data is compromised?

How long have you been using mcrypt? From your comments it sounds
like a week. Is this the extent of your security experience?

I've briefly used the AspEncrypt product you speak of and it is
trivial to understand how the key is generated, but you guys appear to
be baffled by it, so... I don't know, man... situation doubtful.

I would imagine the Mcrypt is even more primitive, so if you are
having such a hard time getting past this most trivial step, it is
more likely you could nail Famke Jannsen tomorrow night than get even
a remotely passable secure design. Does this sound harsh?

But...

If all you are doing is horsing around and just trying to get this to
work as a non-volatile (no one will lose property or get hurt if you
are compromised) project, I can tell you that AspEncrypt derives the
key by hashing (SHA-1 or MD5 per your choice, if I recall) and you can
also use a key which is non-hashed (not recommended for security).

You will also likely need to work in base-64 (which AspEncrypt does
support). I don't know a thing about Mcrypt.

Relevant Pages

  • Re: [PHP] sharing info between websites with XML?
    ... what kind of data you're sharing) in an easy to parse format (CSV, XML, ... It's relatively easy to setup the clients to login ... PHP supports encryption if you install the necessary libraries ... and configure PHP accordingly (manual> Mcrypt Encryption Functions). ...
    (php.general)
  • Re: (S.O.S) Only 4 the best programmers. About Javascript & PHP
    ... > I've a page that sends an encrypted password, using MD5, to a PHP ... > encryption stored on a data base. ... > JavaScript and PHP doesn't return the same value. ...
    (comp.lang.php)
  • sigh back again... php encryption...
    ... I am trying to learn how to send data from a webpage written in php ... $char = chr+ord); ... echo $result; ... This does not need to be the mona lisa, aka DES or 256 bit encryption ...
    (sci.crypt)
  • Re: Workable encryption in Tcl??
    ... >>Considering that I know absolutely nothing about what PHP encryption ... It is a DES implementation ... Its the old Tcl problem of big sumo distro vs. small distro. ...
    (comp.lang.tcl)
  • php to perl translation
    ... I need the result of this script to store the password in out LDAP database in the oracle hashed format. ... The mcrypt functions should be used. ... // Using thirdparty library for DES with CBC encryption ... Concatenate the username and the password to produce a plaintext string; ...
    (perl.beginners)