jCryption - Javascript data encryption, PHP, Java

With jCryption 2.0 you can communicate encrypted with the server, you are no longer bound to just encrypting forms.
This example is a litte more complicated than the other,
but if you want to use jCryption for bidirectional communication just look at the source code … you will understand it with ease.
Just a short explaination what is going on …

1) Client chooses a Password … (in the example a weak one, you should use a good random number in production e.g. mousemovement coordinates)
2) Client requests RSA Public key from Server
3) Client encrypts Password with RSA Public key
4) Server decrypts Password and stores it in the session
5) Server Encrypts the Password with AES and sends it back to the Client
6) Client decrypts it with AES with the Password
7) Both have now the same “secret” key which is used for communication

Here is a litte example how it works.

var $loader = $('<img src="loading.gif" alt="Loading..." title="Loading..." style="margin-right:15px;" />');
$(function() {
	var hashObj = new jsSHA("mySuperPassword", "ASCII");
	var password = hashObj.getHash("SHA-512", "HEX");
 
	$.jCryption.authenticate(password, "encrypt.php?generateKeypair=true", "encrypt.php?handshake=true", function(AESKey) {
		$("#text,#encrypt,#decrypt,#serverChallenge").attr("disabled",false);
		$("#status").html('<span style="font-size: 16px;">Let\'s Rock!</span>');
	}, function() {
		// Authentication failed
	});
 
	$("#encrypt").click(function() {
		var encryptedString = $.jCryption.encrypt($("#text").val(), password);
		$("#log").prepend("\n").prepend("----------");
		$("#log").prepend("\n").prepend("String: " + $("#text").val());
		$("#log").prepend("\n").prepend("Encrypted: " + encryptedString);
		$.ajax({
			url: "encrypt.php",
			dataType: "json",
			type: "POST",
			data: {
				jCryption: encryptedString
			},
			success: function(response) {
				$("#log").prepend("\n").prepend("Server decrypted: " + response.data);
			}
		});
	});
 
	$("#serverChallenge").click(function() {
		$.ajax({
			url: "encrypt.php?decrypttest=true",
			dataType: "json",
			type: "POST",
			success: function(response) {
				$("#log").prepend("\n").prepend("----------");
				$("#log").prepend("\n").prepend("Server original: " + response.unencrypted);
				$("#log").prepend("\n").prepend("Server sent: " + response.encrypted);
				var decryptedString = $.jCryption.decrypt(response.encrypted, password);
				$("#log").prepend("\n").prepend("Decrypted: " + decryptedString);
			}
		});
	});
 
	$("#decrypt").click(function() {
		var decryptedString = $.jCryption.decrypt($("#text").val(), password);
		$("#log").prepend("\n").prepend("----------");
		$("#log").prepend("\n").prepend("Decrypted: " + decryptedString);
	});
 
});

demo »

HTML 5 Session Storage »

Frederik Lassen added an excellent example of how to use the “new” HTML5 Session Storage so the script is not required to request the key everytime from the server instead the “key” is stored in the session.

demo »

If you want to see the old examples here is the link.

Comments (95) Trackbacks (1) ( subscribe to comments on this post )

kreig
May 12th, 2012

Great work! But “man in the middle” attack still can break encryption. Proxy script on some middle server can bypass security. In case you even can’t detect if the certificate signed with wrong certificate. SSL gives “green label” in browser bar (also containing domain name from certificate).
Am I right? Are there any ways to check AES key or determine harmful proxy?

( REPLY )
- Daniel Griesser
  May 13th, 2012
  
  Hi
  Nope … there is no way except SSL to prevent the “man in the middle” attack.
  It just isn’t technology possible without an secure channel which only SSL can supply.
  
  ( REPLY )
Bable
May 12th, 2012

sir, pls send me the code for login uesrname and password using RSA algorithm in client side and tomcat server..

( REPLY )
reymon
March 8th, 2012

i want more codes in encrypting and decrypting data with the textbox and the button.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

( REPLY )
reymon
March 8th, 2012

i need codes in encrypting the data.

( REPLY )
- indios
  March 9th, 2012
  
  want ? need ? please ? thanks ?
  
  ( REPLY )
rajanikant
March 5th, 2012

I want to check the form validation before encrypt it!
Any suggestion.

( REPLY )
varun jadhav
February 22nd, 2012

In bi directional communication when we send request by using $.jCryption.authenticate(),initially it works fine,but after some time it executes the authentication failed function.Why this happens? can anyone tell.

Thanks in advance.

( REPLY )
Gabriel
February 18th, 2012

As I wasn’t able to find a Java implementation available on the web, I implemented my own version (which I called JavaCryption). It is available here: http://jcryptionforjava.wordpress.com/, including a fully working example. I hope it can be useful. Thanks.

( REPLY )
- Dmitriy
  February 25th, 2012
  
  Thanks Gabriel.
  Could you please include full source code though?
  
  ( REPLY )
  - Gabriel
    February 26th, 2012
    
    Hi, the full source code is available on sourceforge. Indeed, I tried to use latin chars (ISO-8859-1) in the beginning, but jCryption only works with UTF-8, so I had to change the encoding. Maybe you could modify the plug-in lines 1045 and 1121 (it’s where the encoding is applied). One question: UTF-8 does not support cyrillic chars?
    
    ( REPLY )
    - Дмитрий
      February 28th, 2012
      
      “UTF-8 (UCS Transformation Format — 8-bit[1]) is a variable-width encoding that can represent every character in the Unicode character set.”
      http://en.wikipedia.org/wiki/UTF-8
      
      ( REPLY )
      - Dmitriy
        February 28th, 2012
        
        “Дмитрий” == “Dmitriy”
        The code I downloaded from Sourceforge has only servlet as source: CryptoServlet.java
        
        Yes, I can decompile easily, but I want to reduce the hassle to other gumbys .
      - Gabriel
        February 28th, 2012
        
        It’s because you downloaded the example, it contains only the binaries. You can download the source here: http://sourceforge.net/projects/javacryption/files/javacryption-1.0/.
- Дмитрий
  February 26th, 2012
  
  Gabriel, your code does not work quite well with Cyrillic chars: cp1251.
  I entered “жас” and “a” did not get decrypted correctly.
  
  Also, Base64 does not work with 16-bit chars in jCryption. Same goes for Apache commons version in java.
  
  ( REPLY )
Dave Harris
February 18th, 2012

Great plugin, thanks for the work on this. I’ve got it setup in a jquery mobile/backbone/requirejs/AMD app and split up the plugin file to 2 files – the plugin, and all the support libraries. At some point I’ll likely refactor the latter as it introduces many globals…will send a push request if/when I get that done.

( REPLY )
Gabriel
February 17th, 2012

Hi! There’s a problem using $.getJSON in IE, it caches the ajax queries (http://www.factory-h.com/blog/?p=67). If the parameters of the call to generateKeypair don’t change, IE assumes the response will be the same, and jcryption won’t work.

( REPLY )
Manoj
February 16th, 2012

hi o like this html 5 session storage but can u give eg…

( REPLY )
Michael
February 10th, 2012

I am wondering if this could be used for the following purpose; I have had an auto complete tool made which caches data from tables in my server on the client side in order to achieve speed/performance. However it also exposes my tables in their entireity which I don’t want to do. Could this be used to store the data encrypted on the client machine and then the AC decrypts when populating? This way the user does not have my table in a readable format.

( REPLY )
- Dave Harris
  February 18th, 2012
  
  It depends on the structure of your table objects. Once the password is established in the session, it’s a simple matter to encrypt/decrypt – but it works on strings, not objects. You could set up a getter for your table object that called $.jCryption.decrypt(encryptedValue, sessionStorage.password). It’s fast, I think it would work well.
  
  ( REPLY )