Encrypted and signed MIME messages using RFC 1847

Question

I need a client-server encryption solution for web transfer, (ie signed and encrypted client-side, and verified and decrypted server-side).

I am using HTTP, but SSL is not available due to shared hosting restrictions (my server is a shared host environment). Looking into alternative solutions, I have decided on OpenPGP using GnuPG . One of the reasons is that it is supported in PHP through various PEAR and PECL modules (PHP is the language I intend to use for both my client script and my server script, though Perl is also available as a last resort).

I am now trying to decide on the best way to transmit the data. I have come across RFC 1847 , which defines encrypted and signed multipart MIME messages. This protocol is extended specifically for PGP in RFC 3156 . (I think these protocols are related to the S/MIME encrypted email protocol).

My question is: is there any reason to follow these standards? As far as protocols go, they look like sensible solutions, but are there any clients that actually use this protocol? For example, if I made a multipart/encrypted request to an Apache web server, will there be any easy way to retrieve the data? My tests using a PHP script made me think that PHP would be no use trying to decipher requests like these ($_POST data seems to come from 'multipart/form-data' MIME-type data).

As my host will let me open sockets, it would be possible for me to use PHP's socket programming API to write a PHP script to act as a server that will accept 'multipart/encrypted' and 'multipart/signed' HTTP requests, but this seems like overkill.

Any suggestions?

For more information on my problem, please see this question .

Answer 1

You're right - these protocols are related to enrypted mail protocol, using that in your case is a little bit of overkill and you wolud have to use OpenSSL php extension. Go with OpenPGP.

Since your client will be written in PHP - consider following scenarios:

Scenario 1: create simple SOAP webservice

Server and Client methods would be the same:

• getPublicKey() - returns public key
• sendMessage(msg) - returns answer

Scenario 2: use GET/POST message

• Client -> HTTP GET (send me your public key) -> Server
• Client <- (my public key is xxxx) <- Server
• Client encrypts message with server's public key Client adds own public key to the message
• Client -> HTTP POST (sends encrypted message) -> Server
• Server decodes the message, and encodes answer with Clients public key
• Client <- (encoded answer to client) <- Server