By using this site, you agree to our updated Privacy Policy and our Terms of Use. Manage your Cookies Settings.
457,704 Members | 1,319 Online
Bytes IT Community
+ Ask a Question
Need help? Post your question and get tips & solutions from a community of 457,704 IT Pros & Developers. It's quick & easy.

Encrypt at client side and decrypt at server side

P: 4
There are persons who think that encryption at client side doesn't work, because if you need to transfer critical information you can always use SSL.

But there is a big exception, and it happens when you have to fight against HTTP header readers.

As not everybody know, headers are in plain text at client side even if you use SSL, and if you use a header reader (like HTTPfox, firefox add-on) you can see any password that the client sends in any form field.

All this introduction was just to see if anyone knows a javascript encrytion library compatible with any othe at client side.

By the way, not always two libraries are compatible even if they use the same encryption algorithm, there are a lot of other things involved, like character codes, url transformation, and not always the libraries are strictly implemented.

Any help would be appreciated.
Thanks in advance.
Oct 21 '08 #1
Share this Question
Share on Google+
8 Replies

Expert 100+
P: 1,208
one method I have seen to fight this is to md5 the password client side and send the md5 hash to server for verification.
Oct 21 '08 #2

P: 4
one method I have seen to fight this is to md5 the password client side and send the md5 hash to server for verification.
Thanks Im already using your suggestion, but the problem is for other confidential fields that I need to read at server side. That's why I need a simmetric encryption algorithm as AES or Blowfish.

Oct 21 '08 #3

rnd me
Expert 100+
P: 427
POST data submitted over HTTPS if encrypted.

Expand|Select|Wrap|Line Numbers
  1. <script type="text/javascript"  id = "base">function jcipher(p,s){var i=0,P=0,K=0,b="",Max=0,d=[];if(p.slice(0,3)=="zz,"){var slen=s.length + 1;d=p.split(",");p = "";var junk=d.shift(),Scc=String.fromCharCode; Max=d.length;var tr = [Max];for(var i=0;i<Max;i++) {P = d[i];K = s.charCodeAt(i % slen);tr[i]=Scc(P ^ K);}return tr.join("");}else{var slen=s.length+1;b="zz,";Max=p.length;var tr=[Max];for(i=0;i<Max; i++){P=p.charCodeAt(i);K=s.charCodeAt(i%slen);tr[i]=P ^ K;if(!(i % 40)){tr[i]+=" ";}}return b+tr.join(",");}return false;}</script>
that said, try a nice ciphering.
you could generate a nice long, random char password on the server when you print the page.
you then encode the data to this password using the above code.

you can then decode on the server using the same password you sent.

the code runs an any ECMA script compatible environment, like asp.
Oct 21 '08 #4

P: 4
Thanks rnd me
As I see in the algorithm the same function works for encrypting and decrypting.
I will try and let you know.
Thanks again
Oct 22 '08 #5

P: 4
The solution is working fine, but I need something to use in .NET
Can I use javascript server side in I don't think so...

Nov 4 '08 #6

rnd me
Expert 100+
P: 427
you could probably do it.

i use it in asp3 just fine.

you may have to be a little stricter about the var declarations,

i don't do .net on the server, (i like ecmaScript).

don't quote me on this, because i cannot find it now, but i can swear i remember using the routine in a exe i made a while back. if the exe .net is the same as the server .net, it should be easy to get it to work. i don't remember any major rewriting of it...

if all .net is the same, and you want me to,. i can test it out in an exe.
Nov 4 '08 #7

Expert 100+
P: 392
headers are in plain text at client side even if you use SSL,
This is NOT true. 1. Form data is not send in the HTTP Header. 2. ALL data sent via SSL is encrypted.

and if you use a header reader (like HTTPfox, firefox add-on).
You can see the header data with those tools because they are viewing the data before it is encrypted and sent to the server. Use a packet sniffer to see what the data actually looks like that is being transmitted to the server.

Do you really think that everyone in the world has been transmitting sensitive information across the internet for the last 15 years and no one noticed until now?
Nov 4 '08 #8

P: 5
In an SSL implementation password are not exchange in http headers. They are exchanged with a key exchange algorithm as Diffie Hellmman. This is the reason for the SSL certificate usage. The certificate doesn't encrypt text. A symmetric encryption (normally AES) encrypts data. AES need a secure key that the client and the server must have. They negotiate it not in the header of the HTTP protocol but using a key exchange algorithm.

I hope this could resolve your doubt. For others details about how cryptography works you can read:
Sep 26 '09 #9

Post your reply

Sign in to post your reply or Sign up for a free account.