Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I would like to know if someone know any library to do encryption in javascript and decryption in java. I have already tried many API, But getting not not getting same values in java. I want public-private key encryption and hence try to use RSA.
Few i have used are:

  1. www-cs-students.stanford.edu/~tjw/jsbn/
  2. ats.oka.nu/titaniumcore/js/crypto/readme.txt
  3. www.ohdave.com/rsa/

Few thing i checked, javascript breaks string into small chunks and then encrypt them which make cipher text different in java and javascript. I edit javascript code to use string as a whole but didn't worked.

I also tried to set charset of html page to utf-8 but it also not worked. I got success in encrypting single character string like 'K' to be encrypted and decrypted correctly which makes me think that there is problem in encrypting string in javascript by dividing it in small chunks (which i checked, but it fails with encrypting it as a whole).

my java implementation is:

BigInteger d = new BigInteger("1f3fac65c4ae222e3a3074dd4c38fbb72c0705c4bbac0385b867c12c25a44e01", 16);
BigInteger e = new BigInteger("65537");
BigInteger N = new BigInteger("b42e91fbca364cf2a125aec67ffbdab624fd401100c40ea05189ba34d1028b0d", 16);
String messageToEncrypt = "kishor";
byte [] messageByte = messageToEncrypt.getBytes();
BigInteger message = new BigInteger(messageByte);
//Encrypting and Decrypting messages
//Encrypt a message using N and e:
BigInteger ciphertext = message.modPow(e, N);
//Decrypt the message using N and d:
BigInteger plaintext = ciphertext.modPow(d, N);
byte[] plainTextByte = plaintext.toByteArray();
String decryptMessage = new String(plainTextByte);
/*System.out.println("p : " + p);
System.out.println("q : " + q);*/
System.out.println("N : " + N.toString(16)); 
System.out.println("e : " + e.toString(16));
System.out.println("d : " + d.toString(16));
/*System.out.println("PhiN : " + PhiN);*/
System.out.println("ciphertext : " + ciphertext.toString(16));
System.out.println("decryptMessage : " + decryptMessage);
}

Kindly let me know if it is possible as i have searched many question (in stackoverflow itself) but unable to find a solution. I am searching for a well tested pre-built library.

share|improve this question
add comment

2 Answers

Is the javascript run in a browser? If so, don't try to encrypt anything at all.

Please refer to my other answer for details. Basically, if you are doing something with javascript, the connection is either a) already secure or b) will not be any more secure with anything you do within the web app.

Note that I talk about hashing there but it really applies to any kind of procedure in javascript.

share|improve this answer
    
Using asymmetric encryption i can protect sensitive data and can easily extract it server side. It can increase a security which is sufficient in my case. If anyone experienced same problem and figured out solution kindly share. –  Kishor Sharma Jul 31 '12 at 12:31
4  
It cannot provide any further security. If you're not using SSL, the attacker can just perform a man-in-the-middle attack and steal the data by giving the user a different key. If you're already using SSL, you don't need more security, and you're just introducing needless complexity. –  Polynomial Jul 31 '12 at 12:44
2  
@KishorSharma - Unless you have a SSL connection no amount of encryption is useful since everything sent to the client and server in a plain text format. Since javascript is client side, any client, would be able to decrypt what you sent. –  Ramhound Jul 31 '12 at 12:53
1  
@KishorSharma What do you mean with "before sending request"? If the attacker is able to access any kind of data on the local machine then no javascript in the world will protect you. –  Zeta Two Jul 31 '12 at 14:15
3  
@KishorSharma The packet is already encrypted with SSL. Any further action will not improve the security. Encryption via Javascript in the browser can not be more secure than the way the javascript was transferred in the first place. For more information, read: matasano.com/articles/javascript-cryptography –  Zeta Two Jul 31 '12 at 14:58
show 2 more comments

Should start from here to Java: http://cryptojs.altervista.org/secretkey/doc/doc_aes_java.html

share|improve this answer
3  
Hi, and welcome to our site. While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. –  Jeff Ferland Sep 7 '12 at 18:47
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.