Version 1.0.1 security update released!
15
Aug/093
Aug/093
The new version is released.
I recommend everbody to download the update because it provides a better random generator and better padding in javascript.
For some more information see the changelog.
By the way, please change your PHP code so the Session variables (keys) will be unset on every request, because this prevents reply/cipher/plain-text attacks.
You can see it when you download the new examples or take a look in the PHP documentation.
Thanks
Daniel
January 14th, 2010
jCryption needs a 2.0 release. Badly. I mean, seriously, as is, jCryption is susceptible to replay attacks and offline brute force attacks. To protect against offline replay attacks, passwords should either have a randomized fixed length salt prepended to them or OAEP padding ought to be used. To protect against replay attacks, nonces ought to be used.
Also, key generation is quite slow as is decryption. Real world RSA implementations employee the Chinese Remainder Theorem to break decryption up into pieces, each of which can be performed faster than treating the whole thing as one giant piece.
My personal recommendation is this: For the javascript portion of the code, use this:
http://www-cs-students.stanford.edu/~tjw/jsbn/
Although the examples are slower than the ohdave.com implementation, it’s faster. The ohdave.com examples don’t employee randomized padding whereas the above implementation does.
For the backend PHP implementation use this:
http://phpseclib.sourceforge.net/
It uses the Chinese Remainder Theorem and the gmp extension if it’s available. If neither gmp or bcmath are available it uses it’s own internal implementation.
January 14th, 2010
Thanks for your reply …
I am currently working on a 2.0 version of jCryption.
I have to admit that I am not a master in encryption/decryption maths and algorithms so thanks for your information.
I will definetly take a closer look at them and how they interact with eachother.
The new version should will support bidirectional communication and “normal string” encryption/decryption.
September 2nd, 2009
Hi Daniel,
have you any implemention with asp.net?
Thanks