Encrypt in Javascript with SJCL and decrypt in PHP

Question

I want to encrypt some data in Javascript and after sending it the php server it could be decrypted.

I'm planig to use JS encryption library as SJCL : http://crypto.stanford.edu/sjcl/ . Up to now I can encrypt my data in JS and send it via ajax post. my JS code lool like this.

sjcl.encrypt('a_key','secured_message');

My question is how do I decrypt my data in php. If it is possible show me how to do it with an example code. (note: SSL is not a option for me, and now I'm planning to use the KEY as generated random number per each request)

Thanks

So you're gonna send an encrypted message with the decryption key on the same channel. You do realize that your encryption is as good as sending plaintext, right? — Adi
– Adi, Commented Aug 16, 2012 at 7:02
It took me quite a bit of pain to replicate the SJCL code into Java (still unfinished). If this isn't directly available (and it probably isn't), it will take quite a bit of knowledge and especially testing to replicate the functionality. — Maarten Bodewes
– Maarten Bodewes, Commented Aug 20, 2012 at 23:02
Please See: stackoverflow.com/questions/5452118/javascript-encryption — Mike
– Mike, Commented May 14, 2014 at 21:54

robocoder · Accepted Answer · 2016-12-25 19:27:05Z

3

PHP 7.1.0 finally adds openssl support for iv and aad parameters BUT it incorrectly enforces a 12 byte iv length.

In your example, we encrypt as follows:

var sjcl = require('./sjcl');
console.log(sjcl.encrypt('a_key', 'secured_message', { mode: 'ccm', iv: sjcl.random.randomWords(3, 0) }));

To get:

{"iv":"YAKkgmNCcVawQtiB","v":1,"iter":10000,"ks":128,"ts":64,"mode":"ccm","adata":"","cipher":"aes","salt":"CwEDE4PXBzY=","ct":"pJ7nmnAGXiC9AD29OADlpFdFl0d/MxQ="}

So, given:

$password = 'a_key';
$input = json_decode('{"iv":"YAKkgmNCcVawQtiB","v":1,"iter":10000,"ks":128,"ts":64,"mode":"ccm","adata":"","cipher":"aes","salt":"CwEDE4PXBzY=","ct":"pJ7nmnAGXiC9AD29OADlpFdFl0d/MxQ="}', true);

We can decrypt in PHP 7.1.0 as follows:

$digest   = hash_pbkdf2('sha256', $password, base64_decode($input['salt']), $input['iter'], 0, true);
$cipher   = $input['cipher'] . '-' . $input['ks'] . '-' . $input['mode'];
$ct       = substr(base64_decode($input['ct']), 0, - $input['ts'] / 8);
$tag      = substr(base64_decode($input['ct']), - $input['ts'] / 8);
$iv       = base64_decode($input['iv']);
$adata    = $input['adata'];

$dt = openssl_decrypt($ct, $cipher, $digest, OPENSSL_RAW_DATA, $iv, $tag, $adata);
var_dump($dt);

answered Dec 25, 2016 at 19:27

robocoder

2494 silver badges9 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

MountainMan Over a year ago

php error: "openssl_decrypt() expects at most 5 parameters, 7 given /..."

Miloš Đakonović · Accepted Answer · 2014-06-20 09:04:39Z

0

While this does not answers your question entirely, I have to:

suggest using crypto-js as most standard complaint JS encryption, hashing and KDF library (that means that provided methods is compatibile with PHP equivalents )
suggest that you read at least first lines of this article where you will learn why all gain from utilizing Javascript cryptography is false sense of security

answered Jun 20, 2014 at 9:04

Miloš Đakonović

3,8715 gold badges39 silver badges57 bronze badges

Collectives™ on Stack Overflow

Encrypt in Javascript with SJCL and decrypt in PHP

2 Answers 2

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related