Source Code:ProduceEncryptionKeys.php
<!-- ProduceEncryptionKeys.php -->
<!-- This Page Is Ready .................. -->
<?php
/*
<one line to give the program's name and a brief idea of what it does.>
Copyright (C) <year> <name of author>
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as
published by the Free Software Foundation, either version 3 of the
License, or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Affero General Public License for more details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
?>
<!DOCTYPE html>
<html>
<meta charset=utf-8>
<head>
<link rel="stylesheet" type="text/css" href="style.css">
</head>
<body>
<div align="center" id="headerCODE">
<a href="code/CodeOfProduceEncryptionKeys.php"></><font color="white"><b>(read) code of this page</b></font></></a>
</div>
<div align="center" id="headerUNO">
<a href="index.php"><h1>brengla.com</h1></a>
</div>
<div align="center" id="header1">
<a href="ReadMessage.php"><h3>(go) read message</h3></a>
</div>
<div align="center" id="header2">
<a href="WriteMessage.php"><h3>(go) write message</h3></a>
</div>
<div align="center">
<!-- HTML FORM -->
<form action="ProduceEncryptionKeysSearchKeys.php" method="post">
<h3>Enter a Unique Username:</h3>
<textarea type="text" cols="30" rows="5" name="NameOfPubKey" maxlength="77"
placeholder="maxlength = '77', && only alphanumerical letters (A–Z, a–z, & numbers)."></textarea></p>
<input type="submit" name="submit" style="height:25px; width:150px"></p>
</form>
</div>
</br>
</br>
</br>
<div align="center" id="footer3">
<a href="DeleteKeys.php#center"><h3>(go) delete keys</h3></a>
</div>
<div align="center" id="footer2">
<a href="DeleteMessage.php#center"><h3>(go) delete message</h3></a>
</div>
<div align="center" id="footer1">
<h3>(@) produce encryption keys</h3></a>
</div>
<div align="center" id="footerUNO">
</br>
copyright, website designed by .......
</br>
</br>
</div>
</body>
</html>
<!-- ProduceEncryptionKeysSearchKeys.php -->
<!-- This Page Is Ready .................. -->
<?php
/*
<one line to give the program's name and a brief idea of what it does.>
Copyright (C) <year> <name of author>
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as
published by the Free Software Foundation, either version 3 of the
License, or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Affero General Public License for more details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
?>
<!DOCTYPE html>
<html>
<meta charset=utf-8>
<head>
<link rel="stylesheet" type="text/css" href="style.css">
</head>
<body>
<div align="center" id="headerCODE">
<a href="code/CodeOfProduceEncryptionKeys.php#search"></><font color="white"><b>(read) code of this page</b></font></></a>
</div>
<div align="center" id="headerUNO">
<a href="index.php"><h1>brengla.com</h1></a>
</div>
<div align="center" id="header1">
<a href="ReadMessage.php"><h3>(go) read message</h3></a>
</div>
<div align="center" id="header2">
<a href="WriteMessage.php"><h3>(go) write message</h3></a>
</div>
<div align="center">
<?php
ini_set ("display_errors", 1);
error_reporting (E_ALL | E_STRICT);
#http://php.net/manual/en/function.ctype-alnum.php
if ( !isset($_POST["NameOfPubKey"]) || !ctype_alnum($_POST["NameOfPubKey"]) ) {
header("Location: ProduceEncryptionKeys.php");
# http://stackoverflow.com/questions/1795025/what-are-the-differences-in-die-and-exit-in-php
exit;
} else {
$NameOfPubKey = $_POST["NameOfPubKey"];
}
# if file exist key generation cannot continue
if ( file_exists("/var/www/html/pubkey/" . $NameOfPubKey) ) {
echo "The requested key: <h3>>> $NameOfPubKey <<</h3> already exists!</br>You need to chose an other new name.</br></br>";
?><form method="get" action="ProduceEncryptionKeys.php">
<button type="submit" style="height:25px; width:150px">Go Back</button>
</form><?php
# if file does not exist proceed with the following
# super else of this page begins here
} else {
echo "The requested key: <h3>>> $NameOfPubKey <<</h3> is unique</br>";
echo "you are welcome to proceed with key generation.</br></br>";
?></br>
<form action="ProduceEncryptionKeysOutput.php" method="post">
<h3>Enter a Password:</h3>
<!-- Remember passwor is divided by four, so a password minimum lenght is 4 chracters -->
<b>(minimum length 4 char.)</b></p>
<!--
type you password in a secure enviroment, rather than <input type="password">
if there is a malware that reads you password, does it matter if its type="password" or type="text".
-->
<textarea type="password" cols="30" rows="10" name="password"
placeholder="Your password will be divided by four; the first quarter will be used to create a hash value (sha512), which in part will become the file name under which your secret key will be stored in a encrypted form (aes256).

Your password - in full quantity - will be used to encrypt your secret key."></textarea></p>
<!-- The usename which is retrived from the past page, is now past forward to the next page (i.e., ProduceEncryptionKeysOutput.php-->
<input type="hidden" name="NameOfPubKey" value="<?php echo $NameOfPubKey; ?>">
<input type="submit" style="height:25px; width:150px"></p>
</form>
<?php
} // end of super else
?>
<!-- HTML FORM -->
</div>
</br>
</br>
</br>
<div align="center" id="footer3">
<a href="DeleteKeys.php#center"><h3>(go) delete keys</h3></a>
</div>
<div align="center" id="footer2">
<a href="DeleteMessage.php#center"><h3>(go) delete message</h3></a>
</div>
<div align="center" id="footer1">
<a href="ProduceEncryptionKeys.php#center"><h3>(go back) produce encryption keys</h3></a>
</div>
<div align="center" id="footerUNO">
</br>
copyright, website designed by .......
</br>
</br>
</div>
</body>
</html>
<!-- ProduceEncryptionKeysOutput.php -->
<!-- This Page Is Ready .................. -->
<?php
/*
<one line to give the program's name and a brief idea of what it does.>
Copyright (C) <year> <name of author>
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as
published by the Free Software Foundation, either version 3 of the
License, or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Affero General Public License for more details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
?>
<!DOCTYPE html>
<html>
<meta charset=utf-8>
<head>
<link rel="stylesheet" type="text/css" href="style.css">
</head>
<body>
<div align="center" id="headerCODE">
<a href="code/CodeOfProduceEncryptionKeys.php#output"></><font color="white"><b>(read) code of this page</b></font></></a>
</div>
<div align="center" id="headerUNO">
<a href="index.php"><h1>brengla.com</h1></a>
</div>
<div align="center" id="header1">
<a href="ReadMessage.php"><h3>(go) read message</h3></a>
</div>
<div align="center" id="header2">
<a href="WriteMessage.php"><h3>(go) write message</h3></a>
</div>
<div align="center">
</br><?php
ini_set ("display_errors", 1);
error_reporting (E_ALL | E_STRICT);
# DEFINE encryption cipher
define('AES_256_CBC', 'aes-256-cbc');
/* ************************************************************* */
/* ********************* generate RSA keys ********************* */
function genRSAkey()
{
$config = array(
# http://security.stackexchange.com/questions/48893/which-digest-algorithm-to-use-with-creating-a-public-private-key-pair
# "digest_alg" => "sha512",
"private_key_bits" => 2048,
"private_key_type" => OPENSSL_KEYTYPE_RSA,
);
// Create the private and public key
# http://php.net/manual/en/function.openssl-pkey-new.php
$res = openssl_pkey_new($config);
// Extract the private key from $res to $PrivKey
# http://php.net/manual/en/function.openssl-pkey-export.php
openssl_pkey_export($res, $PrivKey);
// Extract the public key from $res to $PubKey
# http://php.net/manual/en/function.openssl-pkey-get-details.php
$PubKey = openssl_pkey_get_details($res);
$PubKey = $PubKey["key"];
# the variables $PubKey and $PrivKey is stored in a array, which will then be returned to the function call
# http://php.net/manual/en/function.array.php
$FuncArray = array( "pubkey" => $PubKey, "seckey" => $PrivKey );
return $FuncArray;
}
/* ************************************************************* */
/* ******************* AES 256 encryption ********************** */
function AES256encryption($data, $password)
{
# encryption example copy-pasted from
# http://blog.turret.io/the-missing-php-aes-encryption-example/
# cbc vs ecb
# http://crypto.stackexchange.com/questions/225/should-i-use-ecb-or-cbc-encryption-mode-for-my-block-cipher
// Generate an initialization vector with the lenght of 16 characters
// This *MUST* be available for decryption as well
do {
$iv = bin2hex(fread(fopen("/dev/urandom", "r"), mt_rand(1,16)));
} while (strlen($iv) != 16);
// Encrypt $data using aes-256-cbc cipher with the given encryption key and
// our initialization vector. The 0 gives us the default options, but can
// be changed to OPENSSL_RAW_DATA or OPENSSL_ZERO_PADDING
$encrypted = openssl_encrypt($data, AES_256_CBC, $password, 0, $iv);
// If we lose the $iv variable, we can't decrypt this, so append it to the
// encrypted data with a separator that we know won't exist in base64-encoded
// data
$encrypted = $encrypted . ':' . $iv;
return $encrypted;
}
/*********************************************************************************/
/* *********************** Produce Filename For seckey *************************** */
/*
function ProduceFilenameForSeckey($NameOfPubKey, $QuarterPass)
{
# NameOfPubKey is always alphanumber and QuarterPass can be any character, in this situation
# username "adam" + password "1234", would be the same as username "ada" + password "m1234"
# but if input char "#" inbetween, then username adam#1234 is not ada#m1234
$value = $NameOfPubKey . "#" . $QuarterPass;
# http://php.net/manual/en/function.password-hash.php
$hash = password_hash($value, PASSWORD_DEFAULT);
# the char "/" has to be removed so the name can be used as a file name
# http://php.net/manual/en/function.str-replace.php
$ModHash = str_replace("/", "@", $hash);
# file_put_contents("/var/www/html/seckey/" . $ModHash, $password);
return $ModHash;
}
*/
/* **************************************************************** */
# check if password is set or has minimum number of characters
# remeber password need min number 4, because it will be divided by 4 when the hash value is created from it
# http://php.net/manual/en/function.strlen.php
if ( !isset($_POST["password"]) || ( strlen($_POST["password"]) < 4 ) ) {
header("Location: ProduceEncryptionKeys.php");
# http://stackoverflow.com/questions/1795025/what-are-the-differences-in-die-and-exit-in-php
exit;
} else {
# the $password variable is assigned
$password = $_POST["password"];
}
# http://php.net/manual/en/function.strlen.php
if ( !isset($_POST["NameOfPubKey"]) ) {
header("Location: ProduceEncryptionKeys.php");
# http://stackoverflow.com/questions/1795025/what-are-the-differences-in-die-and-exit-in-php
exit;
} else {
# the $NameOfPubKey variable is assigned
$NameOfPubKey = $_POST["NameOfPubKey"];
}
# super if/else statement
if ( file_exists("/var/www/html/pubkey/" . $NameOfPubKey) ) {
echo "A key with the same name already exist, and thus</br>";
echo "we cannot proceed with the key generation process.</br>";
echo "Please go back and chose a new keyname.</br>";
?>
<form action="ProduceEncryptionKeys.php">
</p><input type="submit" value="Return" style="height:25px; width:150px"></br></br>
</form>
<?php
echo "(Do note, that this message is also shown if you try to recreate your own key.)";
# super else statement , i.e., the key generation process follows now
} else {
# $password; // variable has been set earlier
# $NameOfPubKey; // variable has been set earlier
# generate rsa keys, by calling genRSAkey() function
$opensslRSAkeys = genRSAkey();
# the public key is Saved on server
# pubic key is $opensslRSAkeys["pubkey"]
file_put_contents("/var/www/html/pubkey/" . $NameOfPubKey, $opensslRSAkeys["pubkey"]);
echo "</br><b>Your PUBLIC KEY has been succefully produced and saved</b></br></br>";
# The secret key is encrypted
# secret key is $opensslRSAkeys["seckey"]
$SecKeyEncrypted = AES256encryption($opensslRSAkeys["seckey"], $password);
# now we can unset public- and secret key; the assumption is that this cause some extra security.
# http://php.net/manual/en/function.unset.php
unset($opensslRSAkeys);
# Here we extrat the first 1/4 from the password,
# http://php.net/manual/en/function.substr.php
# http://php.net/manual/en/function.strlen.php
$QuarterPass = substr($password, 0, (strlen($password) / 4));
# NameOfPubKey is always alphanumber and QuarterPass can be any character, in this situation
# username "adam" + password "1234", would be the same as username "ada" + password "m1234"
# but if input char "#" inbetween, then username adam#1234 is not ada#m1234
$value = $NameOfPubKey . "#" . $QuarterPass;
# http://php.net/manual/en/function.password-hash.php
$hash = password_hash($value, PASSWORD_DEFAULT);
# the char "/" has to be removed so the name can be used as a file name
# http://php.net/manual/en/function.str-replace.php
$ModHash = str_replace("/", "@", $hash);
# we change variable name for the sake of convience
$NameOfSecKey = $ModHash;
# check if seckey with same name already exists
if (!file_exists("/var/www/html/seckey/" . $NameOfSecKey)) {
file_put_contents("/var/www/html/seckey/" . $NameOfSecKey, $SecKeyEncrypted);
echo "<b>Your SECRET KEY has been succefully produced and saved.</b>";
echo "<h1>Thank you for chosing our services.</h1></br>";
echo "Note, that your secret key has a cryptolgically disguised name, and that we do not keep logs of which secret key belong to which public key, therefore one can only FIND and access your secret key with the help of the hash functions produced from your password and user name (i.e., name of your public key), and of course with your password in itself.</br></br>";
echo "<b>It is crucial for you to understand, that you are solely responsible for the password you encrypted your secret key with, or to remember the name of your public key. We CANNOT in any form assit you in these matters.</b>";
} else {
# no comment needed
echo "Oh dear, an cryptologycal oddity just happened,</br>a seckey with the same name as yours already exists.</br>";
echo "We Appoligies, but you need to ether change your keyname or your password.</br>";
echo "Please push the return button to continue.</br>";
?>
<form action="ProduceEncryptionKeys.php">
</p><input type="submit" value="Return"></p>
</form>
<?php
}
}
?>
</div>
</br>
</br>
</br>
<div align="center" id="footer3">
<a href="DeleteKeys.php#center"><h3>(go) delete keys</h3></a>
</div>
<div align="center" id="footer2">
<a href="DeleteMessage.php#center"><h3>(go) delete message</h3></a>
</div>
<div align="center" id="footer1">
<a href="ProduceEncryptionKeys.php#center"><h3>(go back) produce encryption keys</h3></a>
</div>
<div align="center" id="footerUNO">
</br>
copyright, website designed by .......
</br>
</br>
</div>
</body>
</html>