My encryption message system & question about security

Question

I made this small tool for make & read easily an encrypted message without nothing to install, just a simple private key like a word or a couple of words to share. (Without say it directly of course but with a guess, like a place gone together with the correspondent, renembered). I think the result message and the system is not bad to run safely for my (basics) needs, anyway an expert view could be great! Please note i am just someone who like learning new things, really not an expert into coding or cryptography!

1. I used this tools:

   • Cryptoxi is the primary script

   • jcryption for aes256 browser encryption

   • Mcrypt for serpent256 server encryption

   • Tinymce

   • Base64 drag &drop

   • jq

   • jq-mobile

   • (..)

2. Here is the routing process:

   • Client connect, send an automatic unique hash generated by javascript, server respond a main and unique key based on the previous hash. This is used for encrypt all future GET and POST requests with aes256 into browser by javascript.

   • Client input a private key, write his message with pictures if need, validate for convert into html and base64 for pictures.

   • Client send this trough the AES tunnel to server.

   • Server decrypt aes, encrypt into serpent-256 & re-send it encrypted to client trough aes tunnel again,so final message is encrypted into serpent256 only. Then client send it by their own tools, like mail or sms.

   • Receiver do the same process on the other side by pasting or just click the generated url with the encrypted hash (Whith ?bin=... php variable on it) and of course by writing the private key.

   • When both user quit or refresh the page, keys and internals data are destroyed.

Here the site, sorry it's French, hope this is not a too big problem! http://cryptop.at/m_.php. Also a YouTube video description (also in French).

So the question is, Do you see some kind of security hole?

Of course the main problem looks like if the primary hash is intercepted, but this allow only one connection, one time, so I think it's just impossible to catch & use this hash for reed the second user private key, or I am wrong?

Answer 1

Based on the details given in the question and the comments, it appears your protocol does nothing to protect the key exchange. The client sends a hash to the server, the server uses that hash to generate a key which it then sends back to the client. Client and server then use that key for future encryption.

Thus, anyone snooping on the key exchange will see the key and can then use it to decrypt and modify future messages. This is a major vulnerability.