0

Hi i am working with JSON. I want to protect my JSON . I am getting JSON on the User Interface side by a service call using a Jquery. Is there some mechanism by which the JSON which i am returning from my service is encrypted JSON and when i am receiving that JSON using JQuery i can decrypt it. But at the time of decryption i dont want to expose the Key or certificate for decryption to the Frontend. How can i protect my JSON.

closed as unclear what you're asking by Eric G, TildalWave, Xander, Gilles, AJ Henderson Apr 9 '14 at 13:44

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Why not use SSL? – David Houde Apr 4 '14 at 20:15
  • 1
    how SSL will help me to encrypt and decrypt the JSON – Utsav Apr 4 '14 at 20:18
  • 1
    Maybe I misunderstood your question. SSL uses encryption to create a secure connection between client and server. Are you looking to encrypt the JSON to protect from evesdropping, or are you wanting to encrypt it to obfuscate the object from the user? – David Houde Apr 4 '14 at 20:32
  • 1
    From what kind of attack do you want to protect your JSON data? – Philipp Apr 5 '14 at 0:18
  • Please read the tour How to Ask and FAQ pages before asking questions. You consistently ask questions that get closed. – Rory Alsop Apr 9 '14 at 16:14
2

Some answers mention here SSL/TLS. SSL/TLS is used to encrypt the whole data between two communicating parties, typically client and server (also called point-to-point encryption). This standard however does not always cover all the security needs, e.g.:

  • if the user wants to encrypt only part of his data.
  • if the user wants to transfer his data over several machines (web services) and does not want the machines see the data, he needs end-to-end security. (In case of TLS, each intermediary machine can decrypt the data, see the content, encrypt it again and forward it to further machine.)
  • if the user wants to store the data encrypted on the server, which receives it.

You did not describe your scenario very well, but I assume you would like to encrypt your json data because of one the above points. If this is the case, you can use the newly standardized JSON Web Encryption Standard (http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption), which gives you possibilities to encrypt json data. Even though it is still a draft, there are already some implementations. If you are implementing a Web site, you can take a look at Web Crypto API (http://www.w3.org/TR/WebCryptoAPI/).

1

The implementation of your requirement is nearly impossible since the client code is in Javascript(Jquery). If you want to hide Json from being captured then consider SSL.

  • 1
    SSL is called TLS nowadays. Still upvoted, though, because what you mean (using https instead of http) is the sanest solution for this problem. – Philipp Apr 5 '14 at 0:13
1

Set up TLS and access the webservice which exposes the JSON data through https. You will need to get a certificate signed by a certificate authority, but besides that it's an easy, reliable and proven way to set up encryption for any kind of web application.

-1

While you to decrypt in client side jquery, It's very difficult you to hide your key.Try SSL on or do decryption in server side.

Not the answer you're looking for? Browse other questions tagged or ask your own question.