Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am trying to think of the best way to encrypt and decrypt a message between two servers. I have found a lot of examples where people simply use a secret and PHP's mcrypt...

http://stackoverflow.com/questions/16600708/php-string-encrypt-and-decrypt

But I am thinking of using certificates instead.

http://stackoverflow.com/questions/7480681/crypt-decrypt-string-php

Am I wrong in my assumtion that it would be more safe? Or is it pretty much the same deal? With certificates you need to get to the private key on the receiving end... with the string version you need some access to the code on one of the two ends to get a hold of it.

And whould the crypto be more safe using certificates? Like creating a 2048-bit RSA.

Thanks.

share|improve this question
    
Mcrypt has only symmetrical encryption. If you want to go for certificates, you need openssl extension which implements asymmetrical encryption. –  Ghigo Mar 6 '14 at 11:27
    
I know what solution I need to do both. My question is what is more secure... –  Ronnie Jespersen Mar 6 '14 at 11:48
1  
The good think about asymmetrical encryption is that remote end cannot encrypt but only decrypt. This is surely a safer approach. –  Ghigo Mar 6 '14 at 11:57
    
Great that was my assumption as well :) –  Ronnie Jespersen Mar 6 '14 at 12:08
    
"need to get the private key on the receiving end" is maybe not the best concept. You would rather "get the public key to the sending end" –  humanityANDpeace Apr 6 '14 at 9:06

2 Answers 2

up vote 1 down vote accepted

Generally speaking, asymmetrical encryption is safer than symmetrical because remote end can only decrypt data, with no possibility to encrypt. The key is only useful for decrypt, server encrypt with a different unpublished key.

Even with self signed certificates, in my opinion security is enhanced comparing to symmetrical encryptions solutions. Go for it.

share|improve this answer
    
the feature that the receiving end is limited to decrypting the message and prevented from encrypting, required that the "public key" is not really public, right? –  humanityANDpeace Apr 6 '14 at 9:01
    
How does the key signing play a role here? –  humanityANDpeace Apr 6 '14 at 9:08
    
"public key" has to be published to clients which want to connect to server. The point of signing a key is to certify that informations inside key are valid and trusted. You require an third party known authority for this and you have to pay. This authority will verify your identity and guarantee for you when clients connect to your server exchanging the signed key. –  Ghigo Apr 7 '14 at 9:22

If you're trying to protect data-in-transit between two servers, please just use SSL/TLS certificates instead of rolling a new encryption scheme. Note that SSL/TLS technically uses symmetric encryption as well, but the shared session keys are encrypted with asymmetric keys during the initial exchange (hence the need for certificates).

One of the huge benefits of SSL/TLS is that it guarantees authentication and data integrity too, not just encryption; depending on choice of ciphersuite, it can also guarantee forward secrecy (such that an attacker who gets the private keys in the future can't decrypt past messages). For instance, if you use mcrypt in AES-CBC mode without message authentication, you're open to malleability attacks similar to http://www.jakoblell.com/blog/2013/12/22/practical-malleability-attack-against-cbc-encrypted-luks-partitions/. And if you didn't initially establish the shared secret over an SSL/TLS-protected channel anyway or use other means of authentication, you're vulnerable to a MITM attack.

SSL/TLS is the most-used form of encryption for server-server or client-server communication, and as such, its security promises (and pitfalls) are well-documented. I'm not familiar with PHP, but ith seems like this does everything you would need: http://www.php.net/manual/en/book.openssl.php.

share|improve this answer
    
+1 for being good enough to mention that in most cases (message length > keylegth of asymmetric key) symmetric encryption is used internally. Showing that the decision in this case is really not possible. It will also be symmetric ciphers involved. –  humanityANDpeace Apr 6 '14 at 9:04
    
I guess my question wasn't written well enough. Of course I am using SSL/TLS as well.. –  Ronnie Jespersen Apr 6 '14 at 12:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.