mhash
I was having a heck of a time finding help on making asynchronous encryption/decryption using private key/public key systems working, and I had to have it for creating a credit card module that uses recurring billing.
You'd be a fool to use normal, 'synchronous' or two-way encryption for this, so the whole mcrypt library won't help.
But, it turns out OpenSSL is extremely easy to use...yet it is so sparsely documented that it seems it would be incredibly hard.
So I share my day of hacking with you - I hope you find it helpful!
<?php
if (isset($_SERVER['HTTPS']) )
{
echo "SECURE: This page is being accessed through a secure connection.<br><br>";
}
else
{
echo "UNSECURE: This page is being access through an unsecure connection.<br><br>";
}
// Create the keypair
$res=openssl_pkey_new();
// Get private key
openssl_pkey_export($res, $privatekey);
// Get public key
$publickey=openssl_pkey_get_details($res);
$publickey=$publickey["key"];
echo "Private Key:<BR>$privatekey<br><br>Public Key:<BR>$publickey<BR><BR>";
$cleartext = '1234 5678 9012 3456';
echo "Clear text:<br>$cleartext<BR><BR>";
openssl_public_encrypt($cleartext, $crypttext, $publickey);
echo "Crypt text:<br>$crypttext<BR><BR>";
openssl_private_decrypt($crypttext, $decrypted, $privatekey);
echo "Decrypted text:<BR>$decrypted<br><br>";
?>
Many thanks to other contributors in the docs for making this less painful.
Note that you will want to use these sorts of functions to generate a key ONCE - save your privatekey offline for decryption, and put your public key in your scripts/configuration file. If your data is compromised you don't care about the encrypted stuff or the public key, it's only the private key and cleartext that really matter.
Good luck!
OpenSSL
- Introducción
- Instalación/Configuración
- Constantes predefinidas
- Parámetros de Clave/Certificado
- Verificación de Certificados
- Funciones de OpenSSL
- openssl_cipher_iv_length — Obtener la longitud del IV de Cipher
- openssl_csr_export_to_file — Exporta una CSR a un archivo
- openssl_csr_export — Exporta una CSR como una cadena
- openssl_csr_get_public_key — Devuelve la clave púbilca de un CERT
- openssl_csr_get_subject — Devuelve el sujeto de un CERT
- openssl_csr_new — Genera una CSR
- openssl_csr_sign — Firmar una CSR con otro certificado (o autofirmar) y generar un certificado
- openssl_decrypt — Desencripta datos
- openssl_dh_compute_key — Computa el secreto compartido para un valor público de una clave DH remota y una clave DH local
- openssl_digest — Computa un método de resumen
- openssl_encrypt — Encripta datos
- openssl_error_string — Devolver un mensaje de error openSSL
- openssl_free_key — Liberar el recurso de clave
- openssl_get_cipher_methods — Obtiene los métodos de cifrado disponibles
- openssl_get_md_methods — Obtener los métodos de resumen disponibles
- openssl_get_privatekey — Alias de openssl_pkey_get_private
- openssl_get_publickey — Alias de openssl_pkey_get_public
- openssl_open — Abre información sellada
- openssl_pbkdf2 — Generates a PKCS5 v2 PBKDF2 string, defaults to SHA-1
- openssl_pkcs12_export_to_file — Exporta un Archivo de Almacén de Certificado Compatible con PKCS#12
- openssl_pkcs12_export — Exporta un Archivo de Almacén de Certificado Compatible con PKCS#12 a una variable
- openssl_pkcs12_read — Convierte un Almacén de Certificado PKCS#12 a una matriz
- openssl_pkcs7_decrypt — Desencripta un mensaje S/MIME encriptado
- openssl_pkcs7_encrypt — Encriptar un mensaje S/MIME
- openssl_pkcs7_sign — Firma un mensaje S/MIME
- openssl_pkcs7_verify — Verifica la firma de un mensaje S/MIME firmado
- openssl_pkey_export_to_file — Obtiene una representación de una clave exportable a un archivo
- openssl_pkey_export — Obtiene una representación de una clave exportable a una cadena
- openssl_pkey_free — Libera una clave privada
- openssl_pkey_get_details — Devuelve una matriz con los detalles de la clave
- openssl_pkey_get_private — Obtener una clave privada
- openssl_pkey_get_public — Extrae la clave pública del certificado y la prepara para usarla
- openssl_pkey_new — Genera una clave privada nueva
- openssl_private_decrypt — Desencripta información con la clave privada
- openssl_private_encrypt — Encripta información con la clave privada
- openssl_public_decrypt — Desencripta información con la clave pública
- openssl_public_encrypt — Encripta información con una clave pública
- openssl_random_pseudo_bytes — Genera una cadena de bytes pseudo-aleatoria
- openssl_seal — Sellar (encriptar) información
- openssl_sign — Generar una firma
- openssl_verify — Verificar una firma
- openssl_x509_check_private_key — Comprueba si una clave privada se corresponde a un certificado
- openssl_x509_checkpurpose — Verifica si un certificado se puede usar para un propósito en particular
- openssl_x509_export_to_file — Exporta un certificado a un archivo
- openssl_x509_export — Exporta un certificado como una cadena
- openssl_x509_free — Liberar un recurso de certificado
- openssl_x509_parse — Analiza un certificado X509 y devuelve la información como un matriz
- openssl_x509_read — Analiza un certificado X.509 y devuelve un identificador de recurso para él
add a note
User Contributed Notes
OpenSSL - [4 notes]
bdh dot hall at gmail dot com ¶
4 years ago
Anonymous ¶
3 years ago
OpenSSL creates asynchronous key pairs, however I wanted to have the private key something that was human-memorizable. With the standard keys generated, this is not possible. How I achieved it was to use two types of encryption.
After generating a key pair with OpenSSL, the public key can be stored in plain text format. I then encrypted the private key itself using regular mcrypt with the human-memorizable key of my choice and converted it to ACSII using base64_encode. Then to get the private key back, I just decrypted it with mcrypt. This way I could store the encrypted private key on the server without worrying about having things stored unencrypted.
Of course, this will only be as good as your human-memorizable key is and can potentially reduce the security of your script if you choose something simple or don't use salts.
koen dot thomeer at pubmed dot be ¶
4 years ago
For checking the status of a client certificate using OCSP, you can use this script:
<?php
// User variables:
$dir = '/path/to/temp/'; // Directory where apache has access to (chmod 777).
$RootCA = '/path/to/Root.cer'; // Points to the Root CA in PEM format.
$OCSPUrl = 'http://ocsp.url'; //Points to the OCSP URL
// Script:
$a = rand(1000,99999); // Needed if you expect more page clicks in one second!
file_put_contents($dir.$a.'cert_i.pem', $_SERVER['SSL_CLIENT_CERT_CHAIN_0']); // Issuer certificate.
file_put_contents($dir.$a.'cert_c.pem', $_SERVER['SSL_CLIENT_CERT']); // Client (authentication) certificate.
$output = shell_exec('openssl ocsp -CAfile '.$RootCA.' -issuer '.$dir.$a.'cert_i.pem -cert '.$dir.$a.'cert_c.pem -url '.$OCSPUrl);
$output2 = preg_split('/[\r\n]/', $output);
$output3 = preg_split('/: /', $output2[0]);
$ocsp = $output3[1];
echo "OCSP status: ".$ocsp; // will be "good", "revoked", or "unknown"
unlink($dir.$a.'cert_i.pem');
unlink($dir.$a.'cert_c.pem');
?>
It can be ameliorated, but it's just a beginning!
Normally, you can extract the ocsp url from the client certificate. Also, an OCSP request contains only the hash of the issuer name, the hash of the issuer's key, and the serial number of the client certificate. All three can be extracted directly from the client certificate.
michelerosica at gmail dot com ¶
1 year ago
<?php
/*-----------------------------------------------------------*
* AES: openSSL (PHP) implementation *
*-----------------------------------------------------------*/
# init
$keySizeInBits = 128;
$keySize = ($keySizeInBits / 8);
# get method
$method = getMethod($keySize, "ofb");
# get the cipher key
$salt = openssl_random_pseudo_bytes(8);
$key = pbkdf2("Secret Passphrase", $salt, 1000, $keySize);
/*-----------------------------------------------------------*
* ENCRYPT: AES 128 bit, OFB *
*-----------------------------------------------------------*/
# get iv
$iv = openssl_random_pseudo_bytes(16);
$iv64 = base64_encode($iv);
# do encryption
$raw = false; // true returns raw bytes, false returns base64
$ciphertext = openssl_encrypt("plaintext", $method, $key, $raw, $iv);
/*-----------------------------------------------------------*
* DECRYPT: AES 128 bit, OFB *
*-----------------------------------------------------------*/
# get the IV
$iv = base64_decode($iv64);
# do decryption
$plain = openssl_decrypt($ciphertext, $method, $key, $raw, $iv);
?>