• State Verified Answer
  • +1 person also asked this people also asked this
  • Replies 4 replies
  • Answers 1 answer
  • Subscribers 1381 subscribers
  • Views 151 views
  • Users 0 members are here
Options
Related

Is the process of encrypting / decrypting a sessionkey documented?

Daniel Brown
$organization

Hi Folks,

Thanks to input here, I'm stuck in to shared sessions. I've found it easy to request a shared session, and to get the contents of that shared session via the API.

My stumbling block is decryption of the encrypted session key - I'm having to use the tool in the Tessitura Admin to decrypt so that I can test.

I know there is a full code sample, but it's not in languages we are currently running on the server I am working on. Is there documentation somewhere of the steps required to encrypt and decrypt (decrypt is key really - I don't need to be able to encrypt I don't think)? I can get a bit of an idea in the PHP code, but my PHP isn't that good - my efforts today have been miss rather than hit and miss!

I'd welcome any input!

Thanks,

Dan

Parents Reply Children
  • 0 $organization in reply to Daniel Gomez

    Thanks DGomez

    That's the most broken down I've seen it, clear and really useful. I'm far more used to JavaScript so should find it easier to understand thanks to your decryption sample too.

    I'm going to focus on everything else I have to do for launch first, and come back to this last - but I think this should give me a massive help!

    Dan

  • 0 $organization in reply to Daniel Brown

    Hey DGomez, just to say thanks - I've used you JavaScript as the basis for a new webpage. My app sends a post request to this, the response being the decrypted string. This would be insecure if public facing, so the page is blocked to external access and can only be requested from within the server.

    It's a bit hacky, but making use of native JavaScript saved installing a load of new encryption components on the server, so it's a quick solution for the rush I'm in now!

    Thanks for everything you sent, it was really helpful - once the pressure is off in terms of launch date, I will use it to build a more elegant approach :)

  • 0 $organization in reply to Daniel Brown

    Hi Daniel,

    If you're looking at implementing your own decryption code in JS then you'd need something like this

    // Values you'll need to get from TNEW admin
     * hmacLength
     * hmacKey
     * blockSize
     * passphrase
     * salt
     * encryptionKeyIterations
     * encryptionKeyLength

    let encryptedSessionKey = 'xxxx'; // with base64 encoding (as we pass it via URL parameter)

    encryptedSessionKey = Buffer.from(encryptedSessionKey, 'base64');
    let hmac = ciphertext.slice(0, hmacLength); // slice hmac based on hmac length
    let encryptedMessage = ciphertext.slice(hmacLength); // slice encrypted message (iv + encrypted bytes)

    let newMac = crypto.createHmac('sha256', hmacKey); // create a new HMAC based on encrypted message 
    newMac.update(encryptedMessage, 'binary');
    newMac = newMac.digest('hex');

    if (hmac.toString('hex') !== newMac.toString('hex')) {
        throw 'Hmac failure';
    }

    let iv = encryptedMessage.slice(0, blockSize); // slice iv from encrypted message

    let encryptedBytes = encryptedMessage.slice(blockSize); // slice encrypted bytes from encrypted message

    let encryptionKey = crypto.pbkdf2Sync(passphrase, salt, encryptionKeyIterations, encryptionKeyLength, 'sha1');// derive key using PBKDF2

    let decipher = crypto.createDecipheriv('aes-256-cbc', encryptionKey, iv);// create cbc decipher with key and iv
    let decrypted = decipher.update(encryptedBytes);// deciper encrypted bytes
    decrypted = Buffer.concat([decrypted, decipher.final()]);

    // This should give you a string with the session key and datetime stamp separated with a pipe
    return decrypted.toString();