Javascript进行表单RSA加密算法 1

最新推荐文章于 2023-06-05 10:30:34 发布

lynnlynnwang

最新推荐文章于 2023-06-05 10:30:34 发布

阅读量1.8k

点赞数

文章标签： javascript 加密 session mysql server user

本文链接：https://blog.csdn.net/lynnlynnwang/article/details/8090021

版权

先做一下这两天的总结

1.昨天晚上 OS project 2 intergrade.

2.看书看到凌晨3点，准备今天OS的midterm.

3.早上上班之后考试.

4.晚上12点之前due这个安全的project.

OMG.......太苦逼了............还好晚上凌晨12点半到家的时候，宝贝给我买了周年礼物。

虽然我不知道他为啥觉得今天的纪念日，但是我很开心。礼物不贵，但是很温馨。我已经感觉到他的改变和成长，他一定会成功的。

下个星期的打算：

1. 开始OS project3 和安全的 man-in-middle-attack.

2. 整理简历并坚持每天发2个简历.

3. 抓紧时间整理出pintos文档post上来。

好吧终于进入正题了,记录一下安全的step6的作业。

实施一个安全的多用户的server, 并且独立设计protocol和cookie的内容和类型。并且要防止repay attack.

protocol: user P<timestamp, H<password>>

cookie: session cookie, content: user, Sign(session_id, user)

Here is the code for login page: 用javascript RSA加密表单 POST 到 server PHP解密。Check：调用数据库比较密码和timestamp。

Key：防止replay attack的关键就是每次发送的都要不一样: fresh every time. 所以我们可以用timestamp和nonce（随机数）。并且每次收到的timestamp要大于之前存在数据库里的timestamp。

<?php 
/* CS683 Step 6 
   Multi-user server:
   Client send encrypt data and server decrypt data, compare value 
   Set session cookie.
   Prevent replay attack. 
*/
if(($_POST['username'])&&($_POST['password'])){


	//1. Connect to database.
	$con = mysql_connect("localhost","root","");
	if (!$con)
	  {
	  die('Could not connect: ' . mysql_error());
	  }
	mysql_select_db("userdatabase", $con);

	//2.Set up for checking information
	//get username
	$username = $_POST['username'];

	//get private key and decrypt password field.
	$prifile = file_get_contents('./private.pem');
	$prikey = openssl_pkey_get_private($prifile);
	openssl_private_decrypt(base64_decode($_POST['password']),$newmessage,$prikey);
	
	//newmessage is the decrpt mesaage. Split into timestamp and sendhpsw
	$tssend= substr($newmessage, 0, 13);
	$sendhpsw = substr($newmessage, 13);


	//Database work: Using username to get H< psw >, timestamp and fetch them to array.
	$p = mysql_query("SELECT * from user where name='$username';");
	$postuser = mysql_fetch_array($p);

	// set up for cookie.
	$sid = (string)session_id();//current session id.
	$cookiedata = $sid.$username;
	openssl_sign($cookiedata,$sign,$prikey);


	/*3.Check: 1.sendH<psw> VS databaseH<psw>(check user). 
	           2.sendtime VS databasetime (prevent replay attack) update
	    	   3.set cookie: username, S(server)<session id, username>
	    	   4.go to private page */

	if($sendhpsw == $postuser['password'])
	{	
		if(floatval($tssend) > floatval($postuser['times']))
		{
			mysql_query("UPDATE user set times = '$tssend' where name='$username';");
			setcookie("username", $username,0);
			setcookie("sign",$sign,0);
			header('Location: private.php');
		}
		else{
			echo "Error: attacker.";
		}

	}
	else{
		echo "Error: Re_enter again please!";
	}
}	

?>


<html>

<body>


<script type="text/javascript" src="jsbn.js"></script>
<script type="text/javascript" src="rsa.js"></script>
<script type="text/javascript" src="sha1.js"></script>
<script type="text/javascript">

//Encrypt data and then submit.
function senddata(event)
{	
	
	//1.Set up for encrypt: get publickey, get form data, H<pwd>, get timestamp.
	var pubkeyfile = "-----BEGIN PUBLIC KEY-----MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDcl8ReQc+jTLplbTs2lHhtjAs2h4PM79/vYoqnTQji2Rj05NF2kbM1/e3ZKUK1cIpDnwm9lZG4OS56G+zbj/KfUyj80PmXu5vtgzSc9UZBRdfkdvj0PChmGWBsNk4Q+RwPKFsPVu1P026iNfwhbj89icooZsPITTtEu9wIF+LC0QIDAQAB-----END PUBLIC KEY-----";

	var pubkey = RSA.getPublicKey(pubkeyfile); 
	var getpwd = document.getElementById("password");
	var hpwd = sha1(getpwd.value);
	var now = new Date();
	var timestamp = String(now.getTime());
	var data = timestamp + hpwd;
	
	//2.Encrypt P <H(pwd),TS>.
	getpwd.value = RSA.encrypt(data, pubkey);

	//3. post data
	document.loginform.submit();
}
</script>

<h1>Login please!</h1>

<form name = "loginform" method="post">
username: <input id = "username" type="text" name="username" />
password: <input id = "password" type="password" name="password" />
<input type="button" value="login" onclick = "senddata(event)" />
</form>

<a href="register.php">Registration for New Users.Click here please!</a>

</body>



</html>

Database: MySQL name;password; timestamp.

lynnlynnwang

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
3
评论
Javascript进行表单RSA加密算法 1

先做一下这两天的总结 1.昨天晚上 OS project 2 intergrade.2.看书看到凌晨3点，准备今天OS的midterm.3.早上上班之后考试.4.晚上12点之前due这个安全的project.OMG.......太苦逼了............还好晚上凌晨12点半到家的时候，宝贝给我买了周年礼物。虽然我不知道他为啥觉得今天的纪念日，但是我很开心。礼物不贵，
复制链接

扫一扫