Encryption Libraries/classes

[dracolytch]

Hey gang,
I need to do some encryption/decryption on some strings, so that I
can pass information in the URL in plain sight. Unfortunately, I have
little control over this particular server, so mcrypt is out. Do any of
you know of any good libraries/classes for this?

Thanks,
~D

[NC]

Re: Encryption Libraries/classes

dracolytch wrote:[color=blue]
>
> I need to do some encryption/decryption on some strings,
> so that I can pass information in the URL in plain sight.[/color]

Why is this preferable to sessions?
[color=blue]
> Unfortunately, I have little control over this particular
> server, so mcrypt is out.[/color]

If you don't need anything industrial strength, the simple
Vernam algorithm should help:

function vernam_encrypt( $strCryptThis, $strKey) {
$strEncrypted = '';
$n = strlen($strCryp tThis);
$k = strlen($strKey) ;
$j = 0;
for ($i = 0; $i < $n; $i++) {
$iKeyChar = ord($strKey{$j} );
$iStringChar = ord($strCryptTh is{$i});
$iCryptChar = $iKeyChar ^ $iStringChar;
$strEncrypted = $strEncrypted . chr($iCryptChar );
if ($j >= $k) {
$j = 0;
} else {
$j = $j + 1;
}
}
return $strEncrypted;
}

function vernam_decrypt( $strEncrypted, $strKey) {
$strDecrypted = '';
$n = strlen($strEncr ypted);
$k = strlen($strKey) ;
$j = 0;
for ($i = 0; $i < $n; $i++) {
$iKeyChar = ord($strKey{$j} );
$iStringChar = ord($strEncrypt ed{$i});
$iDeCryptChar = $iKeyChar ^ $iStringChar;
$strDecrypted = $strDecrypted . chr($iDeCryptCh ar);
if ($j >= $k) {
$j = 0;
} else {
$j = $j + 1;
}
}
return $strDecrypted;
}

Cheers,
NC

[Colin McKinnon]

Re: Encryption Libraries/classes

dracolytch wrote:
[color=blue]
> Hey gang,
> I need to do some encryption/decryption on some strings, so that I
> can pass information in the URL in plain sight. Unfortunately, I have
> little control over this particular server, so mcrypt is out. Do any of
> you know of any good libraries/classes for this?
>
> Thanks,
> ~D[/color]

There's a PHP TEA implementation - try Google.

C.

[dracolytch]

Re: Encryption Libraries/classes

This is preferable to sessions, because my user-base has a habit of
trying to bookmark search results and sending such links to each other
via email/im. So, I make sure that each page someone looks at has all
the parameters in the URL. I've found that it's generally a good habit
to be in. Your results may vary.

This is, of course, in conflict with the security mantra "Trust no
input your user provides", so I end up doing a lot of (sessions cached)
permission checking.

I can't believe I didn't think of a one-time pad. DOH!

Thanks.
~D