note 104420 modified in function.openssl-public-encrypt by danbrown
| From: | danbrown@php.net | Date: | Tue, 14 Jun 2011 19:10:48 +0000 |
| Subject: | note 104420 modified in function.openssl-public-encrypt by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-180526@lists.php.net to get a copy of this message | ||
The confusion most have seems to be on "mixed $key"
The $key is explained in, and mostly the same as the parameter of http://www.php.net/manual/en/function.openssl-pkey-get-public.php
It can take the resource $key returned from openssl_pkey_get_public() OR find the value is text and
passes the text to openssl_pkey_get_public() to get a valid resource.
To better break down rstinnett's example:
(and where the flaw is)
<?php
function EncryptData($source)
{
$fp=fopen("/etc/httpd/conf/ssl.crt/server.crt","r");
$pub_key_string=fread($fp,8192);
fclose($fp);
openssl_get_publickey($pub_key);
openssl_public_encrypt($source,$crypttext,$pub_key_string);
/*this simply passes the string contents of pub_key_string back to be decoded*/
return(base64_encode($crypttext));
}
?>
is more efficient:
<?php
function EncryptData($source)
{
$fp=fopen("/etc/httpd/conf/ssl.crt/server.crt","r");
$pub_key_string=fread($fp,8192);
fclose($fp);
$key_resource = openssl_get_publickey($pub_key);
openssl_public_encrypt($source,$crypttext, $key_resource );
/*uses the already existing key resource*/
return(base64_encode($crypttext));
}
?>
shorter:
<?php
function EncryptData($source)
{
$fp=fopen("/etc/httpd/conf/ssl.crt/server.crt","r");
$pub_key=fread($fp,8192);
fclose($fp);
openssl_public_encrypt($source,$crypttext, $pub_key );
return(base64_encode($crypttext));
}
?>
--was--
The confusion most have seems to be on "mixed $key"
The $key is explained in, and mostly the same as the parameter of http://www.php.net/manual/en/function.openssl-pkey-get-public.php
It can take the resource $key returned from openssl_pkey_get_public() OR find the value is text and
passes the text to openssl_pkey_get_public() to get a valid resource.
To better break down rstinnett's example:
(and where the flaw is)
function EncryptData($source)
{
$fp=fopen("/etc/httpd/conf/ssl.crt/server.crt","r");
$pub_key_string=fread($fp,8192);
fclose($fp);
openssl_get_publickey($pub_key);
openssl_public_encrypt($source,$crypttext,$pub_key_string);
/*this simply passes the string contents of pub_key_string back to be decoded*/
return(base64_encode($crypttext));
}
is more efficient:
function EncryptData($source)
{
$fp=fopen("/etc/httpd/conf/ssl.crt/server.crt","r");
$pub_key_string=fread($fp,8192);
fclose($fp);
$key_resource = openssl_get_publickey($pub_key);
openssl_public_encrypt($source,$crypttext, $key_resource );
/*uses the already existing key resource*/
return(base64_encode($crypttext));
}
shorter:
function EncryptData($source)
{
$fp=fopen("/etc/httpd/conf/ssl.crt/server.crt","r");
$pub_key=fread($fp,8192);
fclose($fp);
openssl_public_encrypt($source,$crypttext, $pub_key );
return(base64_encode($crypttext));
}
more notes to figure out how to get/use keys are posted on:
http://www.php.net/manual/en/function.openssl-pkey-get-public.php
http://php.net/manual/en/function.openssl-public-encrypt.php