php - PHP和Javascript之间的加密/解密

Question

我希望超越这个问题: Obfuscating POST variables between Javascript & PHP

我在哪里想出了这个解决方案:http://pastebin.com/YuAAZTLi

它在 95% 的时间都有效，但我无法真正处理 5%。很难真正基于两个不同服务器的时间。发送带有变量的 rot 太容易破解了。

我希望每次都能更改一些内容，因为我不希望只是重复 HTTP POST 请求。允许 md5 类型加密的 javascript 和 PHP 之间存在哪些加密方法可互换。在哪里

4500 看起来像 Dusfh7sfSFJf78dfns8，而 4501 看起来像 JF7Fhene7fdHfdshf6d ..虽然它们相差 1 位，但一点也不像。

允许使用外部库，但请确保链接了 php 和 javascript 对应项。

Answer 1

它有点特定于处理用户登录的情况，但我在 this answer 中提出了一个协议(protocol), 和提问者 ran with it并编写了一个抗 HTTP 嗅探器的 PHP-to-JavaScript 登录表单实现。

方案要点:

• Generate a random nonce value; this helps prevent replay attacks.
• Send that nonce value and the password salt to the browser along with the rest of the login form.
  • You are storing passwords in salted and hashed form, right?
• When the user enters a password, have the script on the form compute and send back hash(hash(password, salt), nonce) instead.
• When the server receives the form submission, have it compute hash(storedSaltedPassword, nonce) and verify that it equals the submitted value.
  • Retain the nonce value at the server; don't trust the client to echo it back to you, or your replay protection is gone.

The weakness of this scheme is that the password hashes in the database are in some sense password-equivalent; while it's likely infeasible to extract the original password used to produce those hashes, knowledge of the stored hash is sufficient to impersonate the user on your site.