Wednesday, January 25, 2012

Encrypting Transmissions between JavaScript and PHP Part 3: Decrypting with PHP

Welcome to Part3 of Encrypting Transmissions between JavaScript and PHP.  You can see the previous parts at: Part 1 Part 2

There are just four easy steps to go through in order to decrypt the string from Part 2.
As with JavaScript, let's start off by getting the private key loaded into PHP.  Oddly enough, you can do it exactly the same way:


$key = "-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEA3sZto3ZI4vmtMv0Vx+OaliJ/EeVnQ7R+rX8bya+zzoI/S2f7
gD+K/xNK/AD6RZ0Q1dgJ8+Nl1N+DLyDzWvLoFTNbmNJeo+j3VM5I0xXpWeETMtRG
cYysogZILprICezZM5CfC7awAh36xJD35v6mXkwWkAq2QShQDApMJyoFJI2x9DeD
oRIwgMh5pWSaNsfFRJqGaNhWHPZNILkc/PfEeI3JZEjYO7+Bpdgo7VD5jbbPv7R1
xtwko1IClhgPA3jizuQJQnaJL9G6T+MjStXG5mdfnz2oTKBOIFMzblHSlqOYDnhP
7Jbh0x0xE5dPaQQ0fsMxJqWEkDNIcfhWv8BkfQIDAQABAoIBAQCf1AcXDqcOSQlN
GqyEw7PF4Sv/f/GNbrKv8RDTq346O9IDXK/g/DXR+VqD4IOubBiHA79oPg5yIoXw
yxgteTau9zDRPKTvvhWsv28aGo9Xj5aBkjCUCNRWTmF9Jkk8bbQLPcgN1F0Et9OR
MVzaWnqsDrTlVPobVzvO15h5RLl51eOZDHZ1enrIR6gqVksloyVfoWY15Vhdx89k
jbcJ7EMvhQRLZZwIWoP1YIeP/JkREiMju8dMFGazhagZ/ejScCXy+M0LdHMe0Ow2
g5Sx9XYTxCBDj2ReONzVxiih7ZfB0QBT3+ITZIHkEbmXx93azZ98C5v5txTfxBLO
gIN0k1QBAoGBAP8t27t5qMwpEo8dZADo0NC7+qCusENMo4v2YWkyqdYTH2tLNwFK
PpbDuYuqqBClpbKKgUvQOsVaIWRM8Y58r9LiOQTHRfOmYI5W7b9uAj4t2DXP35wj
SdoSV8cBusf/bHd1w8nSAf16e2d5LmFnvIg5zmad8m5vyiWYjE64/8d9AoGBAN99
4pDXrmJ1yMNQVCeT9X2UxG56T18JnxCywE5rSJK5/uPnAGi6d20FV/JDpPe07hOv
lvJzcbYYWvPB0bVw1TkteJsVRmGWo7rwqBpNkofcBNOaEQivOYwv5Yiz97OB5URR
umYauFGI4PUrDH+jn+rlIW/TNtIpkwHqzKgzZ6EBAoGAR4bRKrGlUOTKYPc6Cs83
iOrIC7YrjhGzXg4Hq/cZh/oAOpDwsBnhhV0Da1TAmznzQiJ0r42Ei8EBzx2KMAhf
OFtU5DP/NZaTRhKzvY7WbhtnmV3VLezuTIQLuqqPcnP0MV//K1kEWcq1QIHFMGRl
gkHByx3G0JHhNbyWx5Ivj/kCgYBh5F/zFaXalsDjXDIgS9zBrwIDaiuN80brJ4C4
WKGnMzUEWlCBjvt0k1ycTyjZHzURBl5VwF9UZYKhNopGsS+UJein9T+oyzTYU0Uu
kD/YpnSuwtMnPKk2UFx37mxXAlSMAkhlJNsLS6tNeBe3aNJJLyfgNWHT2EX+Fvyh
yDJiAQKBgFnLzyAWgIECvCmBGmwAl/QK6/6w0P4CEBBt2lBTFB0dFrlkuVC2/DSY
ZLhUMtynmYZEaEreIOJqMXQfHbTUODRVrTfyKVdjvExS5SiwWENYLY/5n+lacZ/b
7iUXpuQdQPttce9IKxqo0DVg7dy7WzmFYGwCfTBTAxvaWvwFc6Pu
-----END RSA PRIVATE KEY-----";
I probably should have used a shorter key length for the demo.  Oh well.  Oh, a word on security.  Embedding your private key actually is a problem if you aren't being extra careful.  It might be wiser to read your key in from a file.  You can find documentation on how to do this in the PHP OpenSSL Documentation.

Next we utilize the PHP OpenSSL library to convert the key string into a resource.
$res=openssl_pkey_get_private($key); 
If you chose to password protect your key, the syntax would instead be:
$res=openssl_pkey_get_private($key,'password'); 
The final two steps are to Base64 decode and decrypt the encrypted text.

$text=base64_decode($_POST['encryptMe']);
openssl_private_decrypt($text,$decryptedText,$res);
That is it folks.  Your decrypted text is now in $decryptedText. Unless something went wrong.  In which case, good luck.

No comments: