a5_encrypt_string

[ebam]

A5_encrypt_string() Function - Encrypts a string using a specified algorithm. Supported algorithms include "blowfish", "des3", "desx" and "idea". This function is much more secure than the encrypt_string() function which has been in all previous versions of Alpha Five.

Does anyone have an idea of how to get further info from Alpha regarding the parameters of the encryption?

Here's my problem:

I'm using this function to encrypt a string and it works just fine. I have a user that is trying to encrypt the same string with the same key using the PHP mcrypt function. His base 64 encoded output is not the same as mine.

In researching this on the internet, it appears that blowfish has several different modes. How do we identify which mode Alpha is using? There is an option initializer that I don't understand either. Maybe the mode is entered here, but in experimenting that doesn't appear to be the case. You can enter just about anything into the initializer and it runs. So, I don't understand what it does.

Anyone have experience with this function or encryption in general that may have an idea?

Thank You.

[Steve Wood]

Re: a5_encrypt_string

I could never figure out Alpha formula. Blowfish encryption is supposed to look like this "3446131B253C8957", but the same string and key using Alpha's function looks like this: "A9itAwKEaao=". Alpha's function returns all sorts of special characters, and every example of Blowfish I find on the web returns only A-Z, 0-9.

I put the question up to one of the engineers at Alpha.

[Peter.Greulich]

Re: a5_encrypt_string

FWIW: You probably already know this, but encryption on the WAS means nothing if you don't employ SSL.

[Steve Wood]

Re: a5_encrypt_string

This method of encryption works without SSL. It is just being used to "encrypt" a sentence or phrase. For instance, tell me what this phrase means: "yn9N2w2p5UA=". You can't because you don't know the passphrase. If you did, you could use a5_decrypt_string() to figure out what the encrypted message meant.

[Peter.Greulich]

Re: a5_encrypt_string

Steve, Doesn't the WAS pass the unencrypted text over the net to the server to execute the function before encryption occurs?

[Steve Wood]

Re: a5_encrypt_string

Sounds like a question for Lenny or Jerry, I think if you asked for a value in a dialog, and then encrypted it, then yes that clear text value would pass over the internet before being encrypted. But in the case below (I happen to know what he is trying to accomplish, I wrote the original application) a 3rd party wants to pass this encrypted value, already encrypted, from their system, and have the WAS decrypt it to get the original value. That decryption would take place on the server with no transmission.

[ebam]

Re: a5_encrypt_string

Steve is correct as to what I'm trying to accomplish.

Steve, have you already sent an e-mail off to Alpha or should I do that?

[Steve Wood]

Re: a5_encrypt_string

Yeah, I sent it to the appropriate engineer. Those functions have been around for a long time and its possible nobody knows. Or that the standards have changed. But as I said, the basic output of the encrypt function seems off, noted by those equal signed at the end which does not seem to match examples outside of Alpha.

[ebam]

Re: a5_encrypt_string

I'm pretty sure they base 64 encode the blowfish encryption. Here's an example of a blowfish encryption that is then converted to base64 after encryption:

Text: MYFILE.PDF
Key: test

Blowfish ECB Encrypted: �N6T�>F&�A��=O
BASE64 Encoded of Above: 45pONlTOPkYmm0Gn4j0fTw==

Hopefully Alpha can provide more detailed instructions of the A5_encrypt_string function. It will be near impossible to match a blowfish encryption created outside Alpha without it.

[Steve Wood]

Re: a5_encrypt_string

Maybe it also has to do with character sets. What are we to do with a string like: "�N6T�>F&�A��=O", or one that ends in an equal sign? They have no practical value because of all the non-standard characters. I remember I used to use base64 or a5_encrypt_string to create encrypted strings for sending in emails as parameters when opening an A5W page. I gave up because the characters would always get munged along the way.

[Peter.Greulich]

Re: a5_encrypt_string

Sounds like a question for Lenny or Jerry, I think if you asked for a value in a dialog, and then encrypted it, then yes that clear text value would pass over the internet before being encrypted. But in the case below (I happen to know what he is trying to accomplish, I wrote the original application) a 3rd party wants to pass this encrypted value, already encrypted, from their system, and have the WAS decrypt it to get the original value. That decryption would take place on the server with no transmission.

Ok, that makes sense.

[Alweth]

Re: a5_encrypt_string

What did you find out about this? I am experiencing the same issue. I can't seem to get the Alpha Five encryption output to agree with other systems.