I made this small tool for make & read easily an encrypted message without nothing to install, just a simple private key like a word or a couple of words to share. (Without say it directly of course but with a guess, like a place gone together with the correspondent, renembered). I think the result message and the system is not bad to run safely for my (basics) needs, anyway an expert view could be great! Please note i am just someone who like learning new things, really not an expert into coding or cryptography!
I used this tools:
Cryptoxi is the primary script
jcryption for aes256 browser encryption
Mcrypt for serpent256 server encryption
Base64 drag &drop
Here is the routing process:
Client input a private key, write his message with pictures if need, validate for convert into html and base64 for pictures.
Client send this trough the AES tunnel to server.
Server decrypt aes, encrypt into serpent-256 & re-send it encrypted to client trough aes tunnel again,so final message is encrypted into serpent256 only. Then client send it by their own tools, like mail or sms.
Receiver do the same process on the other side by pasting or just click the generated url with the encrypted hash (Whith ?bin=... php variable on it) and of course by writing the private key.
When both user quit or refresh the page, keys and internals data are destroyed.
So the question is, Do you see some kind of security hole?
Of course the main problem looks like if the primary hash is intercepted, but this allow only one connection, one time, so I think it's just impossible to catch & use this hash for reed the second user private key, or I am wrong?