I was looking around for concepts in building a reasonably secure HTML login form without using SSL, and I came across an interesting article (link at end of post). The concept it outlines is fairly simple, and I’m a little annoyed that I didn’t think of this myself earlier.
Essentially, the idea is that the password never actually leaves the client machine. Instead, the client sends a cryptographic hash of the password. For other security reasons, we also don’t want the server to store the password in plain text, so it should only store the hash value of the password.
Of course, this alone isn’t enough, because anyone scanning the wire could simply capture the hash and send that along to the server and authenticate. What we need is a way for the server and the client to agree that they have the same hash value for the password, without actually sending it. To accomplish this, we can set up the server to generate a random string and send that to the client. Then, both server and client append the password’s hash to the random string and perform a hash sum on the combined string. The client then sends that string to the server and if it agrees with the result the server got, we have a valid authentication.
The article referenced above included some sample code to illustrate this functionality, but I believe I can simplify it even further. It’s not a practical, real world example, because we’re not sending a user name or retrieving a password from a stored location on the server. But it should be enough to illustrate the concept and give a developer a head start in however they wish to implement. Personally, I plan to instantiate the code in a class and use XMLHttpRequest instead of traditional POST methods.
Anyway, on to the example code. Note: This example doesn’t actually look up any stored user login information. Instead it simply uses a pre-defined password: ‘password’.
We’ll need two files. The first file generates the server’s shared key and passes along the value to the client as well as the HTML and JavaScript needed to input a password, generate hash values and submit the form to the server.
Create main.php with the content:
<?php
// We'll use PHP's session handling to keep track of the server-generated key
session_start();
// Function to generate a random key.
// Modified from code found at: http://www.totallyphp.co.uk/code/create_a_random_password.htm
function randomString($length) {
$chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
$str = NULL;
$i = 0;
while ($i < $length) {
$num = rand(0, 61);
$tmp = substr($chars, $num, 1);
$str .= $tmp;
$i++;
}
return $str;
}
// Call the function and set the shared key
$key = $_SESSION['key'] = randomString(20);
?>
<html>
<head>
<!-- JavaScript that contains the functions which perform the actual hashing -->
<script type="text/javascript" src="http://pajhome.org.uk/crypt/md5/sha1.js"></script>
<!-- The following function creates the hash of the concatenated key and password hash
and submits the content to the server via a form -->
<script type="text/javascript">
function login() {
var p = hex_sha1(document.getElementById('pass').value);
var k = document.getElementById('key').value;
var h = hex_sha1(k+p);
var hash = document.getElementById('hash');
hash.value = h;
var f = document.getElementById('finalform');
f.submit();
}
</script>
</head>
<body>
<form action="javascript:login()" method="post" >
<input type="hidden" id="key" value="<?php echo $key; ?>" />
<input type="password" id="pass" />
<input type="submit" value="Submit" />
</form>
<form action="login.php" method="post" id="finalform">
<input type="hidden" name="hash" id="hash" />
</form>
</body>
</html>
Next we need the file to handle the submitted values and compare the results. Create login.php with the following contents:
<?php
session_start();
$hash = $_POST['hash'];
$pass = sha1('password');
$key = $_SESSION['key'];
$server_hash = sha1($key.$pass);
if ($server_hash == $hash) {
echo "MATCH!";
} else {
echo "NO MATCH!";
}
?>
That’s pretty much it. If you want to see a little more fluid example in action, see: http://www.lightcubesolutions.com/~jhuntwork/secure_login/
Referenced article: PHP – Implementing Secure Login with PHP, JavaScript, and Sessions (without SSL)
