views:

32

answers:

1

Is there any javascript libs that lets you encrypt and decrypt 256 bit AES the way you do it with mcrypt in PHP (and get the same result of course)? I want to give it a variable-length message and a 32 chars key. All libs i find wants fixed-length blocks of cleartext and byte-arrays of keys...

This is how it's done in php:

$iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_ECB);
$iv = mcrypt_create_iv($iv_size, MCRYPT_RAND);
echo mcrypt_encrypt(MCRYPT_RIJNDAEL_256, "32 CHARS THAT REPRESENT MY KEY!!", "hello", MCRYPT_MODE_ECB, $iv);    
A: 

There probably isn't, and even if there is, you should never use it.

The reason why is that everything you put in your JavaScript is public - it can be viewed by the client. So if you put the encrypting key in your JavaScript code, or even if you loaded it from the server with AJAX etc., people could find it easily and crack your encryption.

There is another solution, however: Use AJAX.
You can for instance make a PHP page that gets the data to encrypt through POST, then encrypts it and echoes the encrypted output, all without the client seeing the key. Then the JavaScript code could call that page with an AJAX request and encrypt some data on the server-side.

Frxstrem
I know that everyone can see the key. It doesn't matter in this case.
Martin