Bismillah…

So… is there any workaround for this issue? Fortunately, people out there designed an encoding schemes that can represent binary data into ASCII string format. By represent the binary data into string, the data will be safe from modifications over the network. This encoding scheme is known as Base64 encoding. Quoting the Wikipedia page,

Base64 encoding schemes are commonly used when there is a need to encode binary data that needs be stored and transferred over media that are designed to deal with textual data.

There it is our solution for transporting encrypted data through the network, now let’s try to implements it by writing both of the client and server side code. I’ll use PHP for the client and Java on the server side, because that was basically what I dealt with at my workplace. An important note though, the encryption algorithm must be the same for the both side, this including details like block cipher modes of operation and byte-padding.

For the PHP side, all we need to do is encrypt the message, encode it with Base64 and then sent it with SOAP client. Here’s the example code:

<?php
$secretkey = "123412341234123412341234";
$td = mcrypt_module_open(MCRYPT_TripleDES, '', MCRYPT_MODE_CBC, '');
$blocksize = mcrypt_get_block_size(MCRYPT_TripleDES, MCRYPT_MODE_CBC);
$key = substr($secretkey, 0, mcrypt_enc_get_key_size($td));
$iv = mcrypt_create_iv (mcrypt_get_iv_size(MCRYPT_TripleDES, MCRYPT_MODE_CBC),
    MCRYPT_DEV_RANDOM);

function encrypt($string) {
    global $td
    global $blocksize
    global $key
    global $iv
    mcrypt_generic_init($td, $key , $iv);
    $enc = "";
    $enc = mcrypt_generic($td, pkcs5_pad($string, $blocksize));
    mcrypt_generic_deinit($td);
    return base64_encode($enc);
}

function pkcs5_pad($text, $blocksize) {
    $pad = $blocksize - (strlen($text) % $blocksize);
    return $text . str_repeat(chr($pad), $pad);
}

$client = new SoapClient("http://127.0.0.1:8080/LocalService/ServiceBean?wsdl");
$client->doSomething(encrypt('withMe'), base64_encode($iv));
?>

You might want to refer to the mcrypt manual if you’re still unfamiliar with PHP mcrypt library. To summary, the code will send an encrypted (and Base64 encoded) SOAP message plus another data that contain the Base64 encoded IV. We need to send the IV too because it will be used by the decryption process. The encryption is using Triple DES with CBC block cipher mode and it is also providing a randomized initialization vector (IV) for each call. We also manually pad the input string with PKCS5Padding because PHP didn’t have support for it. Just make sure you have all the necessary libraries i.e. mcrypt and SOAP installed and enabled in your PHP stack.

Now for Java side, it’s literally the reverse of the PHP process. First you decode the Base64 encoded string back into binary and then decrypt it to get the original message. Here’s the example code:

import javax.crypto.Cipher;
import javax.crypto.SecretKey;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;

public class TripleDESUtil {
    public static String decrypt(byte[] message, byte[] iv) throws Exception {
        final byte[] secretkeyBytes = ("123412341234123412341234").getBytes();
        final SecretKey key = new SecretKeySpec(secretkeyBytes, "DESede");
        final IvParameterSpec IV = new IvParameterSpec(iv);
        final Cipher decipher = Cipher.getInstance("DESede/CBC/PKCS5Padding");
        decipher.init(Cipher.DECRYPT_MODE, key, IV);

        final byte[] plainText = decipher.doFinal(message);
        return new String(plainText, "UTF-8").trim();
    }
}

And you can use it like this:

originalMessage = TripleDESUtil.decrypt(Base64.decodeBase64(encodedData),
   Base64.decodeBase64(encodedIV);

The Base64 class and its method is from Commons Codec of Apache Commons. Of course you can write your own implementation if you simply want a Base64 encoder, not an entire library. I use Commons Codec just to simplify this example, and it does ;)

OK, that should wraps things up. Just make sure your server side decryption matched your client side encryption algorithm. That’s the key!

Thank you for reading and I hope it’s useful.

Sesungguhnya yang halal itu nyata dan yang haram itu nyata pula, dan antara keduanya (halal dan haram) terdapat hal-hal yang diragukan (syubhat), banyak orang yang tidak mengetahuinya. Maka barang siapa menghindari syubhat, berarti ia telah menjaga agama dan kehormatannya. Dan barang siapa yang terjatuh ke dalam hal-hal syubhat, niscaya ia terjatuh ke dalam hal yang diharamkan. Perumpamaannya bagaikan seorang penggembala yang menggembala (gembalaannya) di sekitar wilayah larangan, tak lama lagi gembalaannya akan memasuki wilayah itu. Ketahuilah, bahwa setiap raja memiliki wilayah larangan. Ketahuilah, bahwa wilayah larangan Allah adalah hal-hal yang Ia haramkan. Ketahuilah, bahwa di dalam tubuh manusia terdapat segumpal daging (jantung), bila ia baik niscaya seluruh jasad (raga) akan baik, dan bila ia rusak, niscaya seluruh jasad akan rusak pula. Ketahuilah, segumpal daging itu ialah jantung. (HR. al-Bukhari dan Muslim).

Really good quick tutorial and I kinda like my end result. You guys should try it too! It’s quite easy and took no longer than 10 minutes. I’m digging Gimp right now (after long long time not touching it), especially when I feel too tired of programming, and the best part is, it’s actually fun.

The text in my “wallpaper” is from wikipedia if you’re curious about it. At first, I want to make a “silence is” or “… is gold” as in “silence is gold” to match the gold theme, but I ended up doing the aurum thing because my brother were reading a chemistry text book next to me at the time. I added the wikipedia text to fill the space because I thought it felt too empty without one.