I'm trying to find a very secure php encryption that can be decrypted in Android and vice-versa to send data securely. I found old functions not compatible with new versions of PHP. Any ideas please?
Possible duplicate SHA1 in Java and PHP with different results
Encryption and decryption functions are deterministic. If you encrypt SHA-256 on Android, and then decrypt it with PHP, it should work fine. They use the same functionality.
If you have tried this and it didn't work, your problem most likely lies in your encoding method.
Current PHP encryption method:
http://php.net/manual/en/function.openssl-encrypt.php
Function to get available ciphers:
http://php.net/manual/en/function.openssl-get-cipher-methods.php
Related
I am a PHP developer(not an android developer). I outsourced the development of an Android app, and for communication between the app and my PHP server, I intend to have asymmetrical encryption(public-private key encryption).
At PHP level, I know openssl_public_encrypt and openssl_private_decrypt. I told the android developer to use OpenSSL public encryption and RSA encryption to use in-app, but it is not working.
I tried searching, but couldn't find any fruitful results.
Can anyone help me with this, so that I can tell my developer to use a particular method or something?
I found out the answer. openssl_public_encrypt uses RSA algorithm and same can be used in Android in following way:
Cipher cipher = Cipher.getInstance(RSA);
cipher.init(Cipher.ENCRYPT_MODE, publicKey);
What I was doing wrong was using default encryption mode on both sides, PHP as well as Android, which was wrong as they differed.
For more details read : https://stackoverflow.com/a/17820910/3333052
Hello :) I have searched all over to see if this is possible, I am looking to build an application in VB.Net and a website in PHP, both being connected to the same MySQL database. I have managed to get basic connectivity working reading, inserting data etc.
The part I am confused about is the security side, with the PHP site I was looking at Sha1 or MD5 salted encryption, and the same with VB.Net, what I'm wondering is if this is possible, whether both will produce the same hash to compare and authenticate?
Any advice would of great help as I'm just learning these languages :)
SHA1 and MD5 are not secure for hashing passwords.
Bcrypt is built into PHP via the password_hash and password_verify functions, there's a C# library here https://github.com/martinsteel/Bcrypt.NET which is compatible with PHP.
Source for more information: https://paragonie.com/blog/2016/02/how-safely-store-password-in-2016#csharp
For private use only, I'm creating and hosting on my web server a PHP application that retrieves all my passwords for various accounts from a MySQL database and serves them to the client that is an iPhone application which should also be able to insert new passwords in the database.
Instead of sending this data over the internet as plain text I would like to encrypt them before sending them but I'm very new to encryption so I'm feeling a little bit disoriented among all the possible encryption algorithms out there.
While the mcrypt function on PHP seems to be very flexible and compatible with many encryption algorithms I couldn't find anything like that on iOS.
What I wanted was some algorithm easy to implement both on PHP and Objective-C that, given some plain text and an encryption key (stored both on the server and on the client), would encrypt AND decrypt the plain text.
For further detail the server/client communication I had in mind was something like this:
Client sends a request containing some client-specific-app-ID and the service
whose password the server should return
The server checks if that client ID is allowed to get that information
If the client is allowed then the server querys the database and
retrieves the password
The server encrypts the password and sends it to the client
The client decrypts the password and shows it to the user
This thing is for personal use only so I don't need unbreakable security because probably nobody will care breaking it.
I'm doing this just for research and to get started with encryption. I know this is not secure at all.
Do you guys know any two-way encryption algorithm that is easy to use both on php and objective-c that I can use to encrypt passwords on the server and decrypt them in iOS?
Don't bother with your own encryption. You just need to use an SSL link, e.g.
https://yourserver.example.com/getpasswords.php
^---
SSL gives you the encryption for free, and as a bonus allows the iOS client to be reasonably sure that it's connecting to YOUR server, and not some malicious fake server.
We are developing a web application using php/java servlets. i would like to pass encrypted variable from PHP application to Servlet using $GET[] method and decryption from there.
Is there any encryption algorithm to use in both languages?
Edited**
How can i Use Mcrypt Algorithm to do this?
Regards
Yes, use SSL, preferably with client side certificates.
Any encryption algorithm can be used in any language. For HTTP requests the best option would be to use HTTPS - it will require configuration, rather than coding.
This is for an iPhone app which needs to send encrypted data to a web page running php. Symmetric or asymmetric encryption is fine. Example code would be greatly appreciated.
Using SSL would be your best bet.
Look up AquaticPrime on the web if you want sample code, includes PHP and Objective-C. This is a package based on SSL for license key generation.
PHP has the Mcrypt library available to be installed which has a number of algorithms. Find a similar library with support which is callable from Objective-C, and give them a try. To avoid having a key on with the program, asymmetric or public key would be more secure (otherwise, it's just giving the password away).
http://www.php.net/manual/en/function.mcrypt-decrypt.php
You can encrypt it on your iPhone app and then decrypt it in PHP. You can pick an algorithm which is supported by both platforms (possibly AES). For the key, you could do something like concatenating the user's password and a long string (salt), the string being hard coded into the iPhone app and the PHP app.
That way, an attacker couldn't decrypt the messages without knowing the user's password, and both the PHP and iPhone app would know this password.