PHP Secure Communications

Web Technologies

Computing ScienceThompson Rivers University

Secure Comm 2

Unit Topics

How to create a secure connection1. How to use a secure connection; how to authenticate a server

2. How to use user authentication

3. How to work with encrypted data

Secure Comm 3

1. How to Use a Secure Connection

An introduction to secure connections How SSL authentication works How to get a digital secure certificate for your web server How to request a secure connection How to enforce the user to use a secure connection

Secure Comm 4

An introduction to secure connections

[Q] Is it safe to use HTTP to send a credit card number? [Q] What is the solution, then? A secure connection. But a secure connection is much slower than regular HTTP

connections. You usually use secure connections only when your application passes sensitive data.

[Q] How to use a secure connection then? [Q] How to trust web servers? How to trust users?

There are two types of authentication. [Q] What are they? User authentication and server authentication

1.

Advanced Skills 5

How SSL authentication works – how to authenticate a server

HTTPS

Secure Comm 6

With a regular HTTP connection, all data is sent as unencrypted plain text. [Q] What does this mean? Can a hacker read my credit card number?

With a secure connection, all data is encrypted with a secrete key before it is transferred between the client and server.

Secure connection protocols SSL (Secure Sockets Layer) – older TLS (Transport Layer Security) – newer; successor of SSL

The URL for a secure connection starts with HTTPS instead of HTTP.

Secure Comm 7

Before a secure connection is established, the server uses SSL server authentication to authenticate itself. It does this by providing a digital secure certificate to the browser.

[Q] What information is included in a certificate? Name of the server Name of the issuer Expiration date …

[Q] How to trust a certificate? Digitally signed, i.e., encrypted by using the

issuer's private key Only the issuer's public key can be used to

decrypt the certificate. And the issuer should be trustworthy.

Advanced Skills 8

Before a secure connection is established, the server uses SSL server authentication to authenticate itself. It does this by providing a digital secure certificate to the browser. [Q] How to trust a certificate?

By default, browsers accept digital secure certificates that come from trusted sources. [Q] ??? However, if the browser does not recognize the certificate as coming from a trusted source, it informs the user and lets the user view the certificate. Then the user decides.

1.

Secure Comm 9

How to get a digital secure certificate for your web server

[Q] From where? Trustworthy CA (Certificate Authority), and RA (Registration Authority) www.verisign.com www.thawte.com www.geotrust.com www.instantssl.com www.entrust.com

SSL strength 40-bit, 56-bit 128-bit 256-bit [Q] What does this mean?

1.

Secure Comm 10

How to request a secure connection

[Q] How? Once you establish a secure connection, you can use relative URLs

(i.e., relative paths) to continue using the secure connection. [Q] Is it true?

1.

How to redirect to a secure connection

[Q] If you want to make sure that a page is always viewed over a secure connection, what do you have to do?

If you want to make sure that a page is always viewed over a secure connection, you can include code at the top of the page that redirects the page to a secure connection. [Q] What does this mean? How?

If the user requests the page over a regular connection, the web server redirects the request to the same page but over a secure connection.

[Q] How? You need to know whether the user uses http or https.<?php

if (!isset($_SERVER['HTTPS'])) {

$url = 'https://' . $_SERVER['HTTP_HOST'] .

$_SERVER['REQUEST_URI'];

header("Location: " . $url); // Redirect - 302

exit; // should be before any output

} //

?>

Secure Comm 11

Topics

1.

Secure Comm 12

2. How to Use User Authentication

Three types of user authentication How to store and validate a password How to use form-based authentication How to use basic authentication

Secure Comm 13

Three types of user authentication

[Q] How to make only authorized users access some pages? You need to begin by determining whether a client is who and what it

claims to be. This process is known as User Authentication. [Q] Any good idea?

Username and password

Secure Comm 14

Three types of user authentication1. Form-based authentication

a login form By default, no encryption

2. Basic authentication – causes the browser to display a dialog box that gets the username and

password. By default, no encryption

3. Digest authentication causes the browser to display a dialog box that gets the username and

password. Encrypts the username and password before sending them

[Q] Which one looks like the best? [Q] No encryption used in 1) and 2) ?

2.

Secure Comm 15

How to store and validate a password

For most types of authentication, you store the usernames and passwords in a database.

[Q] Encrypted passwords, or unencrypted passwords? A hash function accepts a variable-size string and returns a fixed-size

string known as the hash value. [Q] Always the same hash value for the same input? [Q] Is a hash function reversible?

Password Encryptedpassword Database

Secure Comm 16

// [Q] How to add an email and password into a database?

// $email is used as username in this example

function add_user($email, $password) {

global $db; // [Q] global?

$hashed_password = sha1($password); // SHA-1 hash ft

$query = "insert into users (email, password) values ('$email', '$hashed_password')";

mysqli_query($db, $query);

}

// [Q] How to validate ?

Secure Comm 17

// [Q] How to validate ?

// $email is used as username in this example

function is_valid_user($email, $password) {

global $db;

$hashed_password = sha1($password); // ?

$query = "select userID

from users

where email = '$email'

and password = '$hashed_password'";

$result = mysqli_query($db, $query);

$valid = (mysqli_num_rows($result) == 1);

return $valid;

}

Secure Comm 18

SHA1 uses only 40 bits, and this algorithm is broken. You will need to use a stronger hash function.

// SHA256

hash($algo, $string) $algo: MD5, SHA256, ...

// example

$hashed_password = hash(SHA256, $password);

2.

Advanced Skills 19

How to use form-based authentication

After the user authentication, you will need to move to a protected page. It is also a good idea to use a session.

[Q] What if the user does not use https?

Secure Comm 20

After the user authentication, you will need to move to a protected page. It is also a good idea to use a session.

[Q] Can you make an algorithm for the controller, index.php? Start session; Include necessary functions (model); Get the action, such as login, to perform; If the user isn’t logged in, then $action = 'login' to force the user to login; Switch(action)

'login':

Validate the username and password;

'show_admin_menu':

…

'logout':

Destroy session;

2.

Advanced Skills 21

How to use basic authentication

PHP script can enforce the browser to ask the user to enter username and password.

[Q] Why do we need this? [Q] How?

The $_SERVER arrayPHP_AUTH_USER Returns the username from the

dialog box or a NULL

PHP_AUTH_PW Returns the password from the dialog box

<?php

// require_once('model/database.php');

// require_once('model/admin_db.php');

$email = $_SERVER('PHP_AUTH_USER')

$password = $_SERVER('PHP_AUTH_PW');

if (!is_valid_user($eamil, $password) {

header('WWW-Authenticate: Basic realm = "Admin"');

header('HTTP/1.0 401 Unauthorized');

exit();

}

?>

Secure Comm 22

Topics

2.

Secure Comm 23

3. How to Work with Encrypted Data

[Q] Can we use SHA for encryption/decryption?

How to encrypt and decrypt data A class for storing encrypted data – We will revisit class later.

How to encrypt and decrypt dataMCRYPT_RIJNDAEL_128 The Rijndael cipher with a 128 bit key size.

MCRYPT_RIJNDAEL_192

MCRYPT_RIJNDAEL_256

There are a lot of cipher algorithms.

MCRYPT_MODE_CBC CBC (Cypher Block Chaining) mode

There are also other modes.

mcrypt_get_iv_size($cipher, $mode) Gets the size of initialization vector (iv) used by the cipher algorithm.

mcrypt_create_iv($ivs) creates the initialization vector for the specified size.

mcrypt_encrypt($cipher, $key, $data, $mode, $iv)

mcrypt_decrypt($cipher, $key, $data, $mode, $iv)

base64_encode($data) to help the data survive going through

transport layers; binary to text encoding

base64_decode($data)

Secure Comm 24

$credit_card_no = '4111 1111 1111 1111';

$cipher = MCRYPT_RIJNDAEL_128;

$mode = MCRYPT_MODE_CBC; // cipher block chaining

$key = sha1('secretPassword', true); // true => raw_output; ???

// how to use SHA256 instead?

$ivs = mcrypt_get_iv_size($cipher, $mode);

$iv = mcrypt_create_iv($ivs);

$data = mcrypt_encrypt($cipher, $key, $credit_card_no, $mode, $iv);

$data = base64_encode($data); // to help the data survive going

// through transport layers

echo 'Encrypted data: ' . $data . '<br>';

// transmit $data through the Internet

$data = base64_decode($data);

$credit_card_no = mcrypt_decrypt($cipher, $key, $data, $mode, $iv);

echo 'Decrypted data: ' . $credit_card_no . '<br>';

Secure Comm 25

3.

Secure Comm 26

A class for storing encrypted data – crypt.php<?php

class Crypt {

private $key, $ivs, $iv, $cipher, $mode;

public function __construct() {

$this->cipher = MCRYPT_RIJNAEL_128;

$this->mode = MCRYPT_MODE_CBC;

$this->ivs = mcrypt_get_iv_size($this->cipher, $this->mode);

$this->iv = mcrypt_create_iv($this-ivs);

$this->key = sha1('secreteKey', true);

}

public function encrypt($data) {

...; // [Q] What do you have to do here?

}

public function decrypt($data) {

...; // [Q] What do you have to do here?

}

}

?>

require 'crypt.php';

$credit_card_no = '4111111111111111';

// [Q] How to create an object of Crypt?

$crypt = new Crypt();

// encrypt the data

$data = $crypt->encrypt($credit_card_no);

$data = $crypt->encode($data);

// decrypt the data

$data = $crypt->decode($data);

$data = $crypt->decrypt($data);

Secure Comm 27

Topics

3.