PHP querystring encryption,

[Ian N]

Hi,

I've had to quickly servers and need to turn an ASP script into PHP, i
got the original script from: -

http://www.4guysfromrolla.com/webtech/012000-1.shtml

Does anyone know of a PHP version of this? otherwise it's gonna be a
few hours sifting through it and converting it line by line.

Any suggestions very much welcome.

[JDS]

Re: PHP querystring encryption,

On Mon, 20 Jun 2005 11:06:15 -0700, Ian N wrote:
[color=blue]
> Does anyone know of a PHP version of this? otherwise it's gonna be a
> few hours sifting through it and converting it line by line.[/color]

No, but you can probably do something similar using a combination of
serialize() + urlencode() and decoding it with urldecode()

If you *really* want to obfuscate the query string, try throwing
base64_encode() (and base64_decode() ) into the mix.

Note that this is not really encryption, merely obfuscation, and the ASP
example is also not really encryption, merely obfuscation.

--
JDS | jeffrey@example .invalid
| http://www.newtnotes.com
DJMBS | http://newtnotes.com/doctor-jeff-master-brainsurgeon/

[JDS]

Re: PHP querystring encryption,

On Mon, 20 Jun 2005 14:13:50 -0400, JDS wrote:
[color=blue]
> Note that this is not really encryption, merely obfuscation, and the ASP
> example is also not really encryption, merely obfuscation.[/color]

Ooops, my blow, hank. It really *is* encryption. I just read the article
in more detail.

Look at PHP's mcrpypt* functions.

http://us4.php.net/manual/en/function.mcrypt-module-open.php

later...

--
JDS | jeffrey@example .invalid
| http://www.newtnotes.com
DJMBS | http://newtnotes.com/doctor-jeff-master-brainsurgeon/

[Ian N]

Re: PHP querystring encryption,

Thanks for the reply, i'm looking into the php version now.

My main problem is that it's got to be passed from a PHP server to an
ASP server, so the encryption must be spot on or it won't decrypt.

In theory it should work fine, i'm not so convinced it'll be so simple
in practice sadly.

[NC]

Re: PHP querystring encryption,

Ian N wrote:[color=blue]
>
> I've had to quickly servers and need to turn an ASP script
> into PHP, i got the original script from: -
>
> http://www.4guysfromrolla.com/webtech/012000-1.shtml
>
> Does anyone know of a PHP version of this? otherwise it's gonna be a
> few hours sifting through it and converting it line by line.[/color]

Hours? How about ten minutes? The script given at

http://www.4guysfromrolla.com/webtech/110599-1.2.shtml

translates as follows:

$g_CryptThis = "Now is the time for all good men to come to the aid of
their country.";
$g_KeyLocation = "key.txt";

$g_Key = substr(ReadKeyF romFile($g_KeyL ocation), 0,
strlen($g_Crypt This));

echo "<p>ORIGINA L STRING: ", $g_CryptThis, "<p>";
echo "<p>KEY VALUE: ", $g_Key, "<p>";
echo "<p>ENCRYPT ED CYPHERTEXT: ", EnCrypt($g_Cryp tThis), "<p>";
echo "<p>DECRYPT ED CYPHERTEXT: ", DeCrypt(EnCrypt ($g_CryptThis)) ,
"<p>";

function EnCrypt($strCry ptThis) {
global $g_Key;
for ($i = 0; $i < strlen($strCryp tThis); $i++) {
$iKeyChar = ord($g_Key{$i}) ;
$iStringChar = ord($strCryptTh is{$i});
// *** uncomment below to encrypt with addition,
// $iCryptChar = $iStringChar + $iKeyChar;
$iCryptChar = $iKeyChar ^ $iStringChar;
$strEncrypted = $strEncrypted . chr($iCryptChar );
}
return $strEncrypted;
}

function DeCrypt($strEnc rypted) {
global $g_Key;
for ($i = 0; $i < strlen($strEncr ypted); $i++) {
$iKeyChar = ord($g_Key{$i}) ;
$iStringChar = ord($strEncrypt ed{$i});
// *** uncomment below to decrypt with subtraction
// $iDeCryptChar = $iStringChar - $iKeyChar;
$iDeCryptChar = $iKeyChar ^ $iStringChar;
$strDecrypted = $strDecrypted . chr($iDeCryptCh ar);
}
return $strDecrypted;
}

function ReadKeyFromFile ($strFileName) {
$key = file_get_conten ts($strFileName );
$key = str_replace("\r ", '', $key);
$key = str_replace("\n ", '', $key);
return $key;
}

Cheers,
NC

[NC]

Re: PHP querystring encryption,

Ian N wrote:[color=blue]
>
> My main problem is that it's got to be passed from a PHP
> server to an ASP server,[/color]

Be sure to safeguard the key in both places...
[color=blue]
> the encryption must be spot on or it won't decrypt.[/color]

It is.
[color=blue]
> In theory it should work fine, i'm not so convinced it'll
> be so simple in practice sadly.[/color]

Well, you should try it... :)

Cheers,
NC

[JDS]

Re: PHP querystring encryption,

On Wed, 22 Jun 2005 13:04:40 -0700, NC wrote:
[color=blue]
> Be sure to safeguard the key in both places...[/color]

Maybe, try encrypting the key with another key? And then, for extra
security, encrypt that key with another key. That oughtta do it.

--
JDS | jeffrey@example .invalid
| http://www.newtnotes.com
DJMBS | http://newtnotes.com/doctor-jeff-master-brainsurgeon/