views:

526

answers:

3

So I have a situation where I need to pass some parameters on url. In order to not have id=1 on the url, I added a simple encryption method to obfuscate the values. This has worked fine within the .Net land. Now however, I need to direct from a classic asp page to this .net page that is expecting the parameters to be encrypted. I really am not too familiar with encryption or classic asp and was hoping someone would be able to direct me to a good JS lib, or simply provide a classic asp version of this function? If there's anything wrong with the .Net code, I'd love to hear feedback on that as well.

Here's the encryption method:

public static string Encrypt(string Input)
{
    try
    {
        key = Encoding.UTF8.GetBytes(EncryptionKey.Substring(0, 8));
        var des = new DESCryptoServiceProvider();
        Byte[] inputByteArray = Encoding.UTF8.GetBytes(Input);
        var ms = new MemoryStream();
        var cs = new CryptoStream(ms, des.CreateEncryptor(key, IV), CryptoStreamMode.Write);
        cs.Write(inputByteArray, 0, inputByteArray.Length);
        cs.FlushFinalBlock();
        return Convert.ToBase64String(ms.ToArray());
    }
    catch (Exception)
    {
        return "";
    }
}

And here's the decryption method (I need this to decrypt the classic asp encrypted text):

public static string Decrypt(string Input)
{
    try
    {
        key = Encoding.UTF8.GetBytes(EncryptionKey.Substring(0, 8));
        var des = new DESCryptoServiceProvider();
        var inputByteArray = Convert.FromBase64String(Input);
        var ms = new MemoryStream();
        var cs = new CryptoStream(ms, des.CreateDecryptor(key, IV), CryptoStreamMode.Write);
        cs.Write(inputByteArray, 0, inputByteArray.Length);
        cs.FlushFinalBlock();

        Encoding encoding = Encoding.UTF8;
        return encoding.GetString(ms.ToArray());

    }
    catch (Exception)
    {
        return "";
    }
}

Thanks for any help!

+6  A: 

This isn't some simple translation! Classic ASP doesn't have access to the .NET Framework. You would need to do all of this in Win32 code.

You should package the C# code together as a COM component, which can then be accessed from the Classic ASP site.

John Saunders
Thanks for the input. I considered doing this at one point, but I've had issues accessing custom com components when running under IIS x64. Can anyone confirm this is or is not doable, and if there are any special considerations for implementing under x64?
mklinker
You can access custom COM+ components in x64. I don't know if their are custom steps, but it is possible. We have some legacy code doing it.
Jab
Go into your compile options and under advanced try for CPU targeting x64 specifically and then making sure it is set to register for COM Interop.I have yet to have a problem once I have done that. Also I have found using a .NET deployment works better at registering the DLLs, though I have created BAT files as well, referencing the regasm commands manually.
IPX Ares
Thanks for the additional info, I'll be sure to try it out and post results.
mklinker
While I didn't end up making this change, I feel it's probably the best solution in the end.
mklinker
What did you wind up using?
John Saunders
A: 

Check out Script#

Partha Choudhury
This looks like a very cool project, thanks for the link! After installation, I went to create a new project, but can't seem to get it to build. There's a lot of ambiguous references between sscorlib and mscorelib. Once sscorlib was added to my main solutin I had severl hundred errors to resolve :(
mklinker
Interesting project, but I don't see how it will help OP, because a ‘System.Security.Cryptography‘ equivalent is not available. I'm not sure this would work as server side JScript either.
Thorarin
@mklinker - I didn't try out your example. I installed script# a few days ago as I found it to be pretty cool. Sorry, it didn't work out for you. - P
Partha Choudhury
+1  A: 

I ran into this one on our site which uses ASP & VB.NET. Also, in-house utility programs are written in C#, VB6 & VB.NET. All of the programs needed to be able to exchange encrypted data.

To handle this problem I wrote a VB6 & VBScript encryption routine which I converted to .NET. It allows me to have identical data across the platforms. The encryption & hashing that I selected were RC4 and MD5. Both of which were considerably enhanced with multiple features, such as the MD5 is a salted version and the RC4 contains a CRC check and an option for double encrypting using multiple passkeys.

This is for the minimally sensitive data. For the data that is very sensitive, I wrote a VB6 DLL that does a DES-3 encryption. This DLL is then made available to all platforms.

I put the passkeys in the registry, encrypted using hardware parameters for the password using another encryption method. (If you get them from the registry and try to put them on another system, they're no good.)

Dave
Sounds like a sensible approach, just a bit all-encompassing for my needs currently. I was hoping to find something that didn't require me to implement all of that - but thanks for the feedback as well!
mklinker