Some of you may be familiar with the aSSL project, which uses AJAX/PHP to mimic the SSL protocol. It uses RSA 512 or 1024 for the keys, and AES for the actual data. It looks impressive to me in concept, but am curious to see if you guys see any obvious intercepts that could/would reveal the keys being passed. As we all know, the JS to PHP encryption technique is typically useless as the key is passed in the open to the client side. This appears to be a more advanced approach.
Here are the steps: 1. The browser calls the server to start the process.
The server returns its RSA modulus and the public exponent.
The browser generates a random exchange 128-bit key, encrypts it using the server public key and passes the encrypted exchange key to the server.
The server receives this encrypted 128-bit exchange key, decrypts it with its private key and, if the result is ok, returns the session duration time.
The browser receives the session duration time and sets a timeout to maintain alive the connection.
The URL to the project is here: http://assl.sullof.com/assl/
If this has any potential, I have some ideas on how to further improve on the handshake and secure further the client side.