I made this small tool for make & read easily an encrypted message without nothing to install, just a simple private key like a word or a couple of words to share. (Without say it directly of course but with a guess, like a place gone together with the correspondent, renembered). I think the result message and the system is not bad to run safely for my (basics) needs, anyway an expert view could be great! Please note i am just someone who like learning new things, really not an expert into coding or cryptography!

  1. I used this tools:

    • Cryptoxi is the primary script

    • jcryption for aes256 browser encryption

    • Mcrypt for serpent256 server encryption

    • Tinymce

    • Base64 drag &drop

    • jq

    • jq-mobile

    • (..)

  2. Here is the routing process:

    • Client connect, send an automatic unique hash generated by javascript, server respond a main and unique key based on the previous hash. This is used for encrypt all future GET and POST requests with aes256 into browser by javascript.
    • Client input a private key, write his message with pictures if need, validate for convert into html and base64 for pictures.

    • Client send this trough the AES tunnel to server.

    • Server decrypt aes, encrypt into serpent-256 & re-send it encrypted to client trough aes tunnel again,so final message is encrypted into serpent256 only. Then client send it by their own tools, like mail or sms.

    • Receiver do the same process on the other side by pasting or just click the generated url with the encrypted hash (Whith ?bin=... php variable on it) and of course by writing the private key.

    • When both user quit or refresh the page, keys and internals data are destroyed.

Here the site, sorry it's French, hope this is not a too big problem! http://cryptop.at/m_.php. Also a YouTube video description (also in French).

So the question is, Do you see some kind of security hole?

Of course the main problem looks like if the primary hash is intercepted, but this allow only one connection, one time, so I think it's just impossible to catch & use this hash for reed the second user private key, or I am wrong?

  • $\begingroup$ Comments are not for extended discussion; this conversation has been moved to chat. $\endgroup$
    – e-sushi
    Commented Dec 17, 2017 at 12:56

1 Answer 1


Based on the details given in the question and the comments, it appears your protocol does nothing to protect the key exchange. The client sends a hash to the server, the server uses that hash to generate a key which it then sends back to the client. Client and server then use that key for future encryption.

Thus, anyone snooping on the key exchange will see the key and can then use it to decrypt and modify future messages. This is a major vulnerability.

  • $\begingroup$ I agree could look like, this part is jcryption, and is there just for avoid unencrypted flux, the final message don't uses this key. jcryption.org A MITM is hard to setup i think.. I need to authenticate my server ip for avoid this? Like ssl does? $\endgroup$
    – NVRM
    Commented Oct 4, 2013 at 16:47
  • $\begingroup$ Authenticating the server won't fix the problem if the key exchange is still in the clear. You'd need a strong key exchange (diffie-hellman, SRP, etc), even then there will be a number of issues. Browser based crypto is hardly ever a good idea. Perhaps instead of describing your solution to a problem you should describe the problem in detail (leave out the solution) and there are probably some very standard crypto protocols that will solve your problem. $\endgroup$
    – mikeazo
    Commented Oct 4, 2013 at 21:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.