When passing data to another PHP script using Get or Post, should I encrypt it with a MD5 with salt? or is there a better way to do it?
+3
A:
It depends on what you are trying to accomplish.
Generally, if you only want to verify that the data is coming from your app, pass the data along with a hash that verifies the data hasn't been tampered with.
If you are looking to literally encrypt data in the request, you should look into encryption and not hashing.
$a = 2;
$b = 3;
$hash = sha1($salt.$a.$b)
$link = "http://www.domain.tld/?index.php?a=$a&b=$b&hash=$hash";
Then:
$a = $_GET['a'];
$b = $_GET['b'];
$hash = sha1($salt.$a.$b);
if ($_GET['hash'] == $hash) {
//data ok
} else {
// data has been tampered with
}
code_burgar
2010-01-28 21:03:33
You really want to use a secret key, not a salt, and wind up with a message authentication code. A salt is intended to add random data to make it hard to create a dictionary of all possible values and their hash outputs, as it artifically lengthens the hashed value (if inputs are normally 8 bits, then you've got 2^8=256 possible hashes, but adding 8 bits of salt gets you 2^16=65535 possible values) [continued next comment]
atk
2010-01-28 21:14:42
Very curious, how does a hash confirm that the data hasn't been tampered with? Couldn't I just tamper with it and rehash?
Anthony
2010-01-28 21:15:20
[continued from last comment] If you use just a hash of a salt and the values, then anyone else could recreate the same hash, using the same values - or using different values. By including your a secret key, which only you and the recipient service know, you can authenticate the message came from one side that knows the secret.
atk
2010-01-28 21:17:13
Or is the assumption that the salt is acting like a key, where both parties know it outside of the transmission and thus a man-in-the-middle wouldn't know it? If one end of the conversation is a browser, that would be pretty hard to pull off, wouldn't it?
Anthony
2010-01-28 21:18:16
[continued, again] Alternatively, you can use a digital signature with your public key, if you need *anyone* to be able to confirm that the signed value came from the current script, and not the other side of the connection (with a shared secret, either side could create the MAC, and both sides need the shared secret to validate the MAC, but with a digital signature, the signer needs both a public and a private key, and the verifier needs only the public key)
atk
2010-01-28 21:19:03
@Anthony the assumption is in fact that the salt is acting as a key and is only known to the origin and destination server side scripts.
code_burgar
2010-01-28 21:23:54
+9
A:
What kind of data? MD5 isn't an encryption function, it's a hashing function--once you MD5 it there's no "unencrypt," you can't get the original data back.
If you're transmitting critical data (e.g. credit card, bank account, or social security numbers) you should use a secure SSL connection (i.e. HTTPS).
Jordan
2010-01-28 21:05:10
A:
If you are sending sensible data (such as password, username or even email) you should send this data encrypted in some "strong" way. It can be sent in plain but over HTTPS for example.
If HTTPS is not an option you can always encrypt data with some free/open solutions like GnuPG.
By the way, MD5 is "one way" (but it can be cracked) so you can't un-MD5 easily.
AlexV
2010-01-28 21:09:21
A:
I get the impression that the underlying motivation for this question is the misconception that PHP is less safe than other web-development languages. Other platforms like ASP/.NET may have pre-built methods for keeping things top secret, but those methods only work if they are used. The same goes for PHP. Taking your question as a concern for PHP's security (which is an assumption, and while I could be wrong for you, it is a popular assumption), I would respond: the best way to secure data transfers with PHP is to use the same practices and techniques used for ALL other platforms, such as SSL, strong passwords, confirming IP addresses, not leaving the keys under the mat (ie role-based cookies), and everything else suggested for this question.
Having said that, you obviously want to be secure and want to use PHP, so I'm not jumping down your throat. But I would highly recommend studying up on some basic web-security techniques so that you will know not only how to encrypt your data, but the tons of other things to watch out for as well.
Anthony
2010-01-28 21:30:15
A:
If you do not want to use a HTTPS connection and are not passing sensitive data, I would recommend encrypting the data and possibly using a message authentication code in the process.
You may want to look at the Mcrypt manual.
While not specifically related to GET/POST data, I found an article entitled PHP encryption for the common man that discusses how to secure data in your PHP application.
jschmier
2010-01-28 22:04:15