You create a SecureContext
object and initialize it with the text to be
encrypted or decrypted. The text can be found in strText
member variable.
Operation secure
encrypts the text and operation unsecure
does
the opposite. Both operations take password as an argument.
This piece of code shows how to encrypt the plain text:
var sc = new SecureContext( 'the quick brown fox jumps over the lazy dog' ); sc.secure( '12345678' ); document.writeln( sc.strText );
The output is
[qxolqpadovy hnwduwqdwq biqdcqedijhdeftorszd q gkm d]
This piece of code shows how to decrypt the encrypted text:
var sc = new SecureContext( 'qxolqpadovy hnwduwqdwq biqdcqedijhdeftorszd q gkm d' ); sc.unsecure( '12345678' ); document.writeln( sc.strText );
The output is
[the quick brown fox jumps over the lazy dog ]
As you may observe, the decrypted text has some spaces appended to it. It's because length of the plain text has to be multiple of 13. If it's not, the required number of whitespaces ( ASCII 32, 20h ) is added to the end. This satisfied, the lenghts of the plain and encrypted text are the same
You can allso see that the frequency of letters has changed in the encryptet text. For example, there are two letters 't' in the plain text and only one in the encrypted text. There is only one 'q' in the plain text and 7 of them in the encrypted text. There is no letter repeating 7 times in the plain text (not even the space, but note that there are 17 spaces in the plain text because of the above requirement). This is achieved through transliteration. Transliteration is done before actual encryption, so the frequency of single letters will remain same for any password used.
Normaly, it's not possible to validate that the text was acctualy encrypted with the right password. If this is needed, one may add the signature to the plain text - some known text that is later on searched for.
This piece of code shows how to add validation:
var sc = new SecureContext( 'plain text', 'signature' ); sc.secure( '12345678' );
This piece of code shows how verify if right password was used:
var sc = new SecureContext( 'nseutelt it ptentgattritxa', 'signature' ); if( !sc.unsecure( '12345678' ) ) alert( 'You used bad password.' ); document.writeln( sc.strText );
If the plain text contains new lines, that is 0Dh 0Ah pairs, the decryption will most probably fail.
This is not due to the algorithm itself. The algorithm behaves correctly: it swaps places of characters, possibly moving 0Dh and 0Ah apart - when decryption is done, 0Dh and 0Ah will be glued together again.
But if the encrypted text is pasted into the text editor, or communicated from the server to the client or vice versa, the singleton 0Dh and 0Ah characters may be replaced with 0Dh 0Ah pairs by the agents. What acctually happens is that encrypted text gets modified. Naturaly, the decrypted text will now be different than the originial plain text.
One solution to this problem is to escape the plain text or signature whenewer one cannot be sure that there are no new-lines in the text, or that there is no danger that the encrypted text may be modified by transport agents.
This solution is poor for those who want to be able to change encoding of their pages with emmbeded encrypted text.
Better solution may be to use internal escaping provided by SecureContext
object.
This piece of code shows how to use internal escaping:
var sc = new SecureContext( 'the quick brown fox\njumps over\nthe lazy dog', '', true ); sc.secure( '12345678' ); document.writeln( sc.strText );
The output is
[qx oqi losalhnqyuwogwvzlbmelcjfli\j efwdrpll qtlkfhl]
This piece of code shows how to decrypt text when internal escaping was used:
var sc = new SecureContext( 'qx oqi losalhnqyuwogwvzlbmelcjfli\j efwdrpll qtlkfhl', '', true ); sc.unsecure( '12345678' ); document.writeln( sc.strText );
The output is
[the quick brown fox¬ jumps over¬ the laizy dog]
The internal algorithm simply replaces new lines with '\n', carrige returns with '\r' and backslashes with '\\'.
Encrypted text contains only the letters from the plain text, but in mixed order and changed frequency of single letters.
It is possible to change the character set of the encrypted text, without affecting it's contents.
Length of plain text has to be multiple of 13. If too short, the text is padded with blanks (ASCII 32, 20h). Plain and encrypted text have the same length.
Any plain text can be encrypted in cca. 4x109 ways.
Power of encryption can be enlarged by multiple encryption.
JavaScript 1.2 required (mainly because of String.charCodeAt() operation).
It's recommended that length of plain text (including signature, if present) is multiple of 13. Otherwise, possible attacker will know part of the plain text.
One should not use signature, because this allso reveals part of the plain text to the attacker.
If there is a chance that plain text contains new lines, the JS escape
function should be used on plain text and signature before passing it to the
SecureContext
object, or the object itself should be instructed to
escape the plain text and signature.
This is not too good algorithm for short text. If you want to encrypt the query string, encrypt the whole string rather than single parameters.
This is an example of encrypted address book.
This document: http://www.inet.hr/~tsereg/jse/guide.html