somebody help a PHP noob

[sneakyimp]

My site runs php. My client has ASP. I want to authenticate them so I need to write some ASP for them to jive with my server.

In particular, I need to generate a hash for a secret handshake using the sha1 algoritm. I found an implementation in Javascript and the site there said that ASP machines can interpret Javascript. so here is my approach...let me know if this will work?

Here is the code I wrote for them to put in their page...note that it includes my javascript code using an include directive. note also that I am trying to prevent anyone at all from accessing the javascript code directly because I don't want them to see the inner workings of my site. is that going to work?

the code snip (includes the code below)

<%
Dim myMesg
myMesg = "The bouncer says you can go in"
%>
<!-- #include file = "hex_sha1_js.asp" -->
<%
function UDate(oldDate)
UDate = DateDiff("s", "01/01/1970 00:00:00", oldDate)
end function

// MODIFIED FROM CODE FOUND HERE: http://forums.aspfree.com/code-bank-54/asp-classic-sha1-hash-82166.html
Dim strUserName, intCurrentUnixTime, strPassPhrase
strUserName = "Jason"
intCurrentUnixTime = UDate(Now())
arg1 = "foo"
arg2 = "bar"
arg3 = "doh!"

Dim strCode
strCode = get_secret_code(arg1, arg2, arg3)

Response.Write("User Name: " & strUserName & "<br>")
Response.Write("Unix Timestamp: " & intCurrentUnixTime & "<br>")
Response.Write("Your code: " & strCode & "<br>")
%>

the include named hex_sha1_js.asp...mostly javascript...but will that var check at the very top halt code execution?

<%
if (myMesg != "The bouncer says you can go in") {
Response.Write "IT IS NOT PERMITTED TO ACCESS THIS SCRIPT OUTSIDE OF THE APPLICATION ENVIRONMENT"
Response.End
}
%>
<script language="javascript" type="text/javascript" runat="server">
/*
* A JavaScript implementation of the Secure Hash Algorithm, SHA-1, as defined
* in FIPS PUB 180-1
* Version 2.1a Copyright Paul Johnston 2000 - 2002.
* Other contributors: Greg Holt, Andrew Kepert, Ydnar, Lostinet
* Distributed under the BSD License
* See http://pajhome.org.uk/crypt/md5 for details.
*/

/*
* Configurable variables. You may need to tweak these to be compatible with
* the server-side, but the defaults work in most cases.
*/
var hexcase = 0; /* hex output format. 0 - lowercase; 1 - uppercase */
var b64pad = "="; /* base-64 pad character. "=" for strict RFC compliance */
var chrsz = 8; /* bits per input character. 8 - ASCII; 16 - Unicode */

/*
* These are the functions you'll usually want to call
* They take string arguments and return either hex or base-64 encoded strings
*/
function hex_sha1(s){return binb2hex(core_sha1(str2binb(s),s.length * chrsz));}
function b64_sha1(s){return binb2b64(core_sha1(str2binb(s),s.length * chrsz));}
function str_sha1(s){return binb2str(core_sha1(str2binb(s),s.length * chrsz));}
function hex_hmac_sha1(key, data){ return binb2hex(core_hmac_sha1(key, data));}
function b64_hmac_sha1(key, data){ return binb2b64(core_hmac_sha1(key, data));}
function str_hmac_sha1(key, data){ return binb2str(core_hmac_sha1(key, data));}

/*
* Perform a simple self-test to see if the VM is working
*/
function sha1_vm_test()
{
return hex_sha1("abc") == "a9993e364706816aba3e25717850c26c9cd0d89d";
}

/*
* Calculate the SHA-1 of an array of big-endian words, and a bit length
*/
function core_sha1(x, len)
{
/* append padding */
x[len >> 5] |= 0x80 << (24 - len % 32);
x[((len + 64 >> 9) << 4) + 15] = len;

var w = Array(80);
var a = 1732584193;
var b = -271733879;
var c = -1732584194;
var d = 271733878;
var e = -1009589776;

for(var i = 0; i < x.length; i += 16)
{
var olda = a;
var oldb = b;
var oldc = c;
var oldd = d;
var olde = e;

for(var j = 0; j < 80; j++)
{
if(j < 16) w[j] = x[i + j];
else w[j] = rol(w[j-3] ^ w[j-8] ^ w[j-14] ^ w[j-16], 1);
var t = safe_add(safe_add(rol(a, 5), sha1_ft(j, b, c, d)),
safe_add(safe_add(e, w[j]), sha1_kt(j)));
e = d;
d = c;
c = rol(b, 30);
b = a;
a = t;
}

a = safe_add(a, olda);
b = safe_add(b, oldb);
c = safe_add(c, oldc);
d = safe_add(d, oldd);
e = safe_add(e, olde);
}
return Array(a, b, c, d, e);

}

/*
* Perform the appropriate triplet combination function for the current
* iteration
*/
function sha1_ft(t, b, c, d)
{
if(t < 20) return (b & c) | ((~b) & d);
if(t < 40) return b ^ c ^ d;
if(t < 60) return (b & c) | (b & d) | (c & d);
return b ^ c ^ d;
}

/*
* Determine the appropriate additive constant for the current iteration
*/
function sha1_kt(t)
{
return (t < 20) ? 1518500249 : (t < 40) ? 1859775393 :
(t < 60) ? -1894007588 : -899497514;
}

/*
* Calculate the HMAC-SHA1 of a key and some data
*/
function core_hmac_sha1(key, data)
{
var bkey = str2binb(key);
if(bkey.length > 16) bkey = core_sha1(bkey, key.length * chrsz);

var ipad = Array(16), opad = Array(16);
for(var i = 0; i < 16; i++)
{
ipad[i] = bkey[i] ^ 0x36363636;
opad[i] = bkey[i] ^ 0x5C5C5C5C;
}

var hash = core_sha1(ipad.concat(str2binb(data)), 512 + data.length * chrsz);
return core_sha1(opad.concat(hash), 512 + 160);
}

/*
* Add integers, wrapping at 2^32. This uses 16-bit operations internally
* to work around bugs in some JS interpreters.
*/
function safe_add(x, y)
{
var lsw = (x & 0xFFFF) + (y & 0xFFFF);
var msw = (x >> 16) + (y >> 16) + (lsw >> 16);
return (msw << 16) | (lsw & 0xFFFF);
}

/*
* Bitwise rotate a 32-bit number to the left.
*/
function rol(num, cnt)
{
return (num << cnt) | (num >>> (32 - cnt));
}

/*
* Convert an 8-bit or 16-bit string to an array of big-endian words
* In 8-bit function, characters >255 have their hi-byte silently ignored.
*/
function str2binb(str)
{
var bin = Array();
var mask = (1 << chrsz) - 1;
for(var i = 0; i < str.length * chrsz; i += chrsz)
bin[i>>5] |= (str.charCodeAt(i / chrsz) & mask) << (32 - chrsz - i%32);
return bin;
}

/*
* Convert an array of big-endian words to a string
*/
function binb2str(bin)
{
var str = "";
var mask = (1 << chrsz) - 1;
for(var i = 0; i < bin.length * 32; i += chrsz)
str += String.fromCharCode((bin[i>>5] >>> (32 - chrsz - i%32)) & mask);
return str;
}

/*
* Convert an array of big-endian words to a hex string.
*/
function binb2hex(binarray)
{
var hex_tab = hexcase ? "0123456789ABCDEF" : "0123456789abcdef";
var str = "";
for(var i = 0; i < binarray.length * 4; i++)
{
str += hex_tab.charAt((binarray[i>>2] >> ((3 - i%4)*8+4)) & 0xF) +
hex_tab.charAt((binarray[i>>2] >> ((3 - i%4)*8 )) & 0xF);
}
return str;
}

/*
* Convert an array of big-endian words to a base-64 string
*/
function binb2b64(binarray)
{
var tab = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwx yz0123456789+/";
var str = "";
for(var i = 0; i < binarray.length * 4; i += 3)
{
var triplet = (((binarray[i >> 2] >> 8 * (3 - i %4)) & 0xFF) << 16)
| (((binarray[i+1 >> 2] >> 8 * (3 - (i+1)%4)) & 0xFF) << 8 )
| ((binarray[i+2 >> 2] >> 8 * (3 - (i+2)%4)) & 0xFF);
for(var j = 0; j < 4; j++)
{
if(i * 8 + j * 6 > binarray.length * 32) str += b64pad;
else str += tab.charAt((triplet >> 6*(3-j)) & 0x3F);
}
}
return str;
}

function get_secret_code(arg1, arg2, arg3) {
return 'foobar'; // obviously this is different
}
</script>

[so_is_this]

ASP/JavaScript cannot be seen by the client browser. It is executed completely on the server side and never sent to the client. To use JScript with ASP, you must code this at the top of your document:

<% @Language=JScript %>

I don't know that you can use two different scripting languages at the same time in a single ASP document.

[russell]

it won't work.

you cant include cross-domain in ASP like u can in PHP. best to encrypt a cookie and use that, plus the domain and or ip of the client to authenticate. in fact, we do this very thing in one of my projects. can also use an iframe to do the authentication -- iframe source CAN be a PHP file on your server. other than that, it would've worked with a couple of modifications:

as so_is_this said, need the script tag at the very top. also, would need to remove your script tags (both the opening and closing tags) and just use the one so_is_this shows.

by the way...
I don't know that you can use two different scripting languages at the same time in a single ASP document.you can.

[sneakyimp]

it won't work.
you cant include cross-domain in ASP like u can in PHP. best to encrypt a cookie and use that, plus the domain and or ip of the client to authenticate. in fact, we do this very thing in one of my projects. can also use an iframe to do the authentication -- iframe source CAN be a PHP file on your server. other than that, it would've worked with a couple of modifications:


i wasn't very clear i guess. these two scripts are both running on the client's machine and are only intended to create a 'secret handshake' value. I didn't write the code that create the link to my site.

users who are logged in to their server have a particular username. when they want to visit my site, they visit a page on the remote ASP server derived from my example that takes the username and the current Unix Time stamp (current GMT time in seconds since January 1, 1970) and then they use this 'secret handshake' code generator to combine those two values into a hash. the username, timestamp, and hash are combined into a single URL that points to my site. e.g.:
http://mydomain.com/foo.php?username=Jason&timestamp=1662343423&hash=ea76d7ae6d6aed76ad76ae76da9

when they arrive at my site, the username, unix timestamp, and the hash value they generated are extracted from the query string. my script runs the mirror image of the functions i posted in the code here and validates them. if the hash value they presented is the correct function of the username and timestamp (and the timestamp isn't too old) then they are logged in.

[russell]

sweet. oughtta work out then

[so_is_this]

by the way...
you can.
How so? ...if the @Language directive specifies the scripting language to use?

[sneakyimp]

take a look at the site i got the code from:
http://forums.aspfree.com/code-bank-54/asp-classic-sha1-hash-82166.html

for what it's worth, i don't have "@Language=JScript" at the top of the included file.

btw, i *really* appreciate the help on this guys. i'll head over to the php forum here and see if i can help out.

[russell]

How so? ...if the @Language directive specifies the scripting language to use?
consider the following:

<%@ Language=VBScript %>
<%
Response.Write "<h4>Hello from VBS</h4>"
sayHelloFromJS
%>

<script runat=server language=jscript>
function sayHelloFromJS() {
Response.Write("<h4>Hello From JScript");
}
</script> note that vbScript is calling a JScript method -- and it works! the output:

Hello from VBS
Hello From JScript
rarely used, but a useful tool.

[so_is_this]

OK, thought that might be the answer. ;)

[sneakyimp]

so do you think i need this at the top of my include file?


<%@ Language=VBScript %>

[russell]

not likely. thats the default, unless someone explicitly changed it in IIS

[so_is_this]

so do you think i need this at the top of my include file?

<%@ Language=VBScript %>

It is always good to be explicit. ;-)