Question

So I have a situation where I need to pass some parameters on url. In order to not have id=1 on the url, I added a simple encryption method to obfuscate the values. This has worked fine within the .Net land. Now however, I need to direct from a classic asp page to this .net page that is expecting the parameters to be encrypted. I really am not too familiar with encryption or classic asp and was hoping someone would be able to direct me to a good JS lib, or simply provide a classic asp version of this function? If there’s anything wrong with the .Net code, I’d love to hear feedback on that as well.

Here’s the encryption method:

public static string Encrypt(string Input)
{
    try
    {
        key = Encoding.UTF8.GetBytes(EncryptionKey.Substring(0, 8));
        var des = new DESCryptoServiceProvider();
        Byte[] inputByteArray = Encoding.UTF8.GetBytes(Input);
        var ms = new MemoryStream();
        var cs = new CryptoStream(ms, des.CreateEncryptor(key, IV), CryptoStreamMode.Write);
        cs.Write(inputByteArray, 0, inputByteArray.Length);
        cs.FlushFinalBlock();
        return Convert.ToBase64String(ms.ToArray());
    }
    catch (Exception)
    {
        return "";
    }
}

And here’s the decryption method (I need this to decrypt the classic asp encrypted text):

public static string Decrypt(string Input)
{
    try
    {
        key = Encoding.UTF8.GetBytes(EncryptionKey.Substring(0, 8));
        var des = new DESCryptoServiceProvider();
        var inputByteArray = Convert.FromBase64String(Input);
        var ms = new MemoryStream();
        var cs = new CryptoStream(ms, des.CreateDecryptor(key, IV), CryptoStreamMode.Write);
        cs.Write(inputByteArray, 0, inputByteArray.Length);
        cs.FlushFinalBlock();

        Encoding encoding = Encoding.UTF8;
        return encoding.GetString(ms.ToArray());

    }
    catch (Exception)
    {
        return "";
    }
}

Thanks for any help!

Answer 1

Don’t mean to answer my own question, but I couldn’t get the code added as a comment. Anyway, I ended up implementing RC4 on the client anyway. For anyone who may be interested (wth are you doing working in classic asp?? 🙂 ) Here’s the relevant code – hope it helps! As always, if anyone spots a problem with this snippet, please let me know!

Thanks,

Matt

Dim sbox(255)
Dim key(255)

Sub RC4Initialize(strPwd)
  dim tempSwap
  dim a
  dim b

  intLength = len(strPwd)
  For a = 0 To 255
     key(a) = asc(mid(strpwd, (a mod intLength)+1, 1))
     sbox(a) = a
  next

  b = 0
  For a = 0 To 255
     b = (b + sbox(a) + key(a)) Mod 256
     tempSwap = sbox(a)
     sbox(a) = sbox(b)
     sbox(b) = tempSwap
  Next

End Sub

Function EnDeCrypt(plaintxt)
  dim temp
  dim a
  dim i
  dim j
  dim k
  dim cipherby
  dim cipher

  i = 0
  j = 0

  RC4Initialize "somesortofpassword"

  For a = 1 To Len(plaintxt)
     i = (i + 1) Mod 256
     j = (j + sbox(i)) Mod 256
     temp = sbox(i)
     sbox(i) = sbox(j)
     sbox(j) = temp

     k = sbox((sbox(i) + sbox(j)) Mod 256)

     cipherby = Asc(Mid(plaintxt, a, 1)) Xor k
     dim h
     h = hex(cipherby)
     if Len(h) = 1 then
        h = "0" & h
      end if
     cipher = cipher & h
  Next

  EnDeCrypt = cipher
End Function