Hello,
In the past we have done all our encryption using MD5 hash, however I
am now working with a new client that wants to exchange RSA keys.
They are using pure Java on their side, and we are using scripts (vbs
and javascript within asp pages) on our side (we are limited to this
and cannot use .NET or JAVA at this time).
They would like to send us a URL with some encrypted data (i.e.
&token=xxxxx). They are asking me to generate a RSA key pair, send
them my public key and then use my private key to decrypt the data
they send via the URL.
Based on the research I've done so far (admittedly I am somewhat
confused), it looks like I need to generate the key pair using IIS
(MMC snap-in with v5). Then I need to use CAPICOM to decrypt the data
they send.
I have tried using CAPICOM within my asp page and was able to load up
a certificate they sent (one test) and was also able to encrypt and
decrypt using the following example I found on the Internet:
<%
Const CAPICOM_ENCRYPTION_ALGORITHM_RC4 = 1 ' Use RSA RC4 encryption.
Const CAPICOM_KEY_LENGTH_128_BITS = 3 ' Use 128-bit keys if available
strTestMessage = "Hello World!"
strPassphrase = "A#0x?\$dE<"
'Encrypt:
Set xEncrypt = Server.CreateObject("CAPICOM.EncryptedData")
xEncrypt.Content = strTestMessage
'Both methods below work
xEncrypt.SetSecret strPassphrase
'xEncrypt.SetSecret "Password", CAPICOM_SECRET_PASSWORD
xEncrypt.Algorithm.Name = CAPICOM_ENCRYPTION_ALGORITHM_RC4
xEncrypt.Algorithm.KeyLength = CAPICOM_KEY_LENGTH_128_BITS
strEncryptedMsg = xEncrypt.Encrypt()
Response.Write "Encrypted=" & strEncryptedMsg & "<P>"
'Decrypt:
xEncrypt.Decrypt(strEncryptedMsg)
strPlainText = xEncrypt.Content
Response.Write "Decrypted=" & strPlainText
Response.Write "<P>DONE"
%>
Question(s): Is the above example considered symmetric since the
"same password" is used to encrypt/decrypt. Can a private key be used
in place of the password? If so, is the private key automatically
found on the server when calling the decrypt method or do I need to
load it? If not, do I have to use the EnvelopedData method? Can I
use EnvelopedData method even if the person sending the encrypted text
used JAVA to generate?
I would appreciate any help to clarify appropriate usage.
Many Thanks,
Kristine