I'm learning about web security mechanisms. I have developed the following system in PHP and JavaScript:

assuming that I have a page named: messages.php which is a real-time chat system.

  1. first when the page loads, a page id is generated and then an Encryption Key is stored into a Session called $_session["key".page_id]. using page_id makes it possible to use a unique encryption key for each opened "messages.php" page in the browser. the encryption key and the page id are also echoed to the page in this way: var key = [generated_key_stored_in_session] and var page_id = [generated_page_id].
  2. when the user sends a message, it is first encrypted using AES with the variable key as the encryption key. after encryption, the encrypted message and the page_id variable will be sent to the server with POST method using Ajax.
  3. Now the server receives the data and loads encryption key from Session using the received page_id. and the received message will be decrypted and stored to the database.
  4. And now the server generates a new key sets a $_session["key".page_id] with that and then echoes the new encryption key which will be received by Ajax and be used for further encryption.

I think that this method is not safe because the encryption key is transferred as text and it's possible to read that with traffic monitor tools.

I've read about storing the key in a JavaScript file and send the file to the client. how is this method?

What is the best way to send the key? and how can I implement Public Key/Private Key system here?

  • So, why don't you simply use HTTPS? – Gudradain Jul 25 '14 at 17:19
  • I can simply do this. but as I mentioned I'm learning about data security, and really like to be able to develop this system for educational purposes. – Agha Jul 25 '14 at 18:10
  • If you are learning about security, then I recommend learning SSL/TLS. This would prevent someone from eavesdropping per your question. – David Houde Jul 29 '14 at 16:35

The jsencrypt library implements RSA encryption in javascript which might be what you want but it sounds like you are attempting to create a more basic encryption implementation for educational purposes. I would suggest reading through this library's source and try to pull out pieces that would be relevant to your project.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.