Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

I am using ECC algorithm for security. Now the concern is I am placing the data in web page after encryption of the data in hex format and transmit to server and then it decrypts the data, but when I encrypt the data then at that time then the method returns me the byte [] and then I will have to convert that byte [] into Base64 byte [], if I am not doing this thing then it gives me error of bad padding while decrypting the data. so my conern is why I need to convert that byte [] data into Base64 byte [] data ?

share|improve this question

4 Answers

up vote 7 down vote accepted

It sounds like you are using cryptography improperly. There is no reason to store encrypted data within an html page. Further more ECC and another asymmetric algorithms are very resource intensive. A symmetric cipher should be used with a mode that has authentication.

But most importantly. Why aren't you using HTTPS?

share|improve this answer
Why can't we store encrypted data in HTML it is not HTML Page but it is JSP page and the encrypted data is generated on the fly and the data will be stored in hidden field. – NullPointerException Jan 22 '12 at 8:11
1  
@Bhavik Ambani Where are you going to put the key? Who is your attacker? Why doesn't HTTPS solve your problem? – Rook Jan 22 '12 at 8:24
The key will be present at server side, the data will be placed for validation of some information residing in the request from the user. And for the single problem we can not change our whole product architecture in https format – NullPointerException Jan 22 '12 at 8:35
1  
I assume you are storing part of the application state in a hidden field, much like what ASP.NET does with its ViewState. There are two problems that need solving: 1. avoid users tampering with the viewstate, and 2. avoid exposing internal program state through the viewstate. The second one can be solved with encryption, or by simply not putting such information into the viewstate; the first one can be solved with encryption, or by adding a secure digest hash (with a salt only known to the server). – tdammers Jan 22 '12 at 14:02
1  
@Bhavik Ambani All pages must load over HTTPS and you should read OWASP a9. It will consume far less resources than this design because HTTPS uses symmetric ciphers for data transfer. Further more, your design provides zero added security benefit because you are unable to obtain a secure channel. – Rook Jan 22 '12 at 17:01
up vote 2 down vote

Use Session, store what ever you need in Session object (without encryption)

share|improve this answer
up vote 2 down vote

If you don't want the user to touch something simply use session variables.(Ex. $_SESSION)

If you want to protect the end user get a nice certificate and deliver only trough HTTPS.

share|improve this answer
up vote 1 down vote

I'm going to have to agree with Rook, and say whatever you're doing, you're doing it wrong.

To answer your question, the reason you have to convert binary data into a base64 encoded string is that binary data cannot be reliably encoded into a text-only document (like HTML) without doing some convert-to-text transformation on it, the most popular of which is base64 encoding. I won't get into details, but there a a number of things that have to do with character sets and stuff. Other transforms exist (hexadecimal output, for example) but base64 is probably the simplest way to go.

That said, you probably shouldn't do whatever you're doing. If you need to transmit data to the client securely, then use SSL/TLS/HTTPS. Otherwise, you're not doing it securely. If you need to store data client-side which the client won't read, then just don't. Store the data on your server and provide the client with a session key that references the server storage location. Otherwise, you're not doing it securely.

Really.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.