Interesting stuff, i have a question,while our swf can be decompiled ,flash still have a lack of security, its mean attacker can view the the algorithm or see the key on flash. In other hands,with php,the attacker can see the post transaction using network debugger tool,and they know the incoming-outgoing data. How about that ?

Thank you :)

Obfuscation can almost eliminate this problem with decompiling a Flash movie. Using this security method all the POST data is encrypted so revealing this data with a http analyzer is not going to be useful.

thanks you Shane for your explanation and great article stuff, AES its good solution, anyway are you ever using steganography method ,we/php inject the security code at random pixel position on image,and flash can read the secret information of the pixel.

Thank you

I have used something like this which allowed the user to create an image which also stored several settings which are bitwise options to be detected by an interpreter.

Hi,Mc.When you say Obfuscation,could you name a method or tool to do that?Thx

I use SWF Encrypt.

Oh my god, guy. This article is amazing. It will be very useful to me, I would encrypt a lot of data on XML.

Thanks for sharing, your blog is one the best on AS3.

I got another question to do: can you share with us the php files used to into the “AES-PHP.fla” example?

I tryed to found them following the php link you post in the blog, but I failed…

A big thank you for sharing! Looking for hours for a solution to the as3crypto – PHP issue. This works perfect. Cheers!!

The AES encryption for PHP is on this blog

Thanks Shane. I watched your personal portfolio, your sites are awesome. You’re my new Flash Superhero, but I got a question: what is the best way to improve Flash Design skill to maximum level, like you did?

(Sorry for my ugly english, I’m italian :) )

Hey thanks Andrea for your kind words.

Well I can’t take credit for the design on all my projects as I often work with amazing team who help with this. This said its still a major plus having a creative and design background. I studied at an Australian university majoring in Visual Communication, because this was a university degree it was quite theoretical focusing on semiotics and advertising psychology which is far more useful long term.

What I do these days still requires these skills all of the time, as well as some new skills which I learnt along the way. I often have to make decisions regarding creative direction, as well as artistic direction with things like how does the site feel, sound etc.

I think it’s super important for Flash Developers who want to work in the advertising industry (as I do) to have a stronger skill set in the design and creative areas, than just having pure programming know how (this can be easily taught). Further to this having excellent Maths skills is also very useful for making games.

So I recommend try starting with some self motivated projects that have a creative or design focus this may be photography, illustration, t-shirt design. This will help you discover and learn some things about creative process. If self motivation is not a strong point then maybe look into courses at a college or university. Though what I found during my time at university, you usually only receive as much as you decide to put in.

Hey Shane, is this compatible to Java’s AES ?

I would hope so, I have not tried. Does java have built in AES support?

Thank you for sharing this code… and sorry for my english… but I’m facing a problem with implementation. I’m using encryption on the Flex side and all is OK. But on PHP side, I can’t get back the string decrypted. Flex code is :
var crypt:String = AES.encrypt(‘text’, ‘thekey’, AES.BIT_KEY_256);
myService.getOperation(‘serviceLogin’).send(crypt);
PHP code is :
require_once(‘../aes-lib.php’);
$decrypted = AESDecryptCtr($crypt,’thekey’), 256);
And so $decrypted does not correspond to ‘thetext’. Do I do something wrong ?
Thanks in advance…

Well to be anal, in your example you encrypt ‘text’ then expecting ‘thetext’ but this is probably a typo. I can only expect you are not using the correct PHP AES library I used this one

tried to use this method though amfphp and it doesn’t work, the AESDecryptCtr function does not decrypt correctly the string passed by amf… i’m guessing it’s an encoding issue but i’ll keep trying… any clues ??

I am not to sure but you would think it would work the same. I think it might be like you say or something more basic to do with the key or block cipher you are using on either side. Try my demos in this post if they don’t work with the same encryption text then we can be fairly certain it’s a coding bug with the library or otherwise ;)

broke my head down trying to make it work but it just didn’t, funny thing is it actually worked like a charm in Zend AMF implementation… i guess i’ll stick with it … still sad cause i couldn’t find out what was the issue… anyway thanks for the code !!! keep it up!

Ahh ok it must be something wierd then in the version of AMFPHP you were trying over the one in ZendAMF. I would say it’s some kind of unexpected charcode changes which happen using the AMF service.

with amfphp replace $SBox and $RCon with $GLOBALS['Sbox']. The issue is probably how class member access globals.

Thx as3developer/Shane, that’s just what i needed! :-). Works fine now over amfphp!

Nice job guys, it’s always great when something works! :)

Hi Shane, this all seems very easy to use, but I have one question.
If I trace the actual key variable it is not in hex. If I change these values into hex – is this the actual key?

Thanks and well done for bringing us this. I know almost nothing of cryptography.

Steve

You can have the key in hex if you like or not as in my demo.

Hi Shane, I got a question. What charset is used by the “encrypt” output string? Is it plain ASCII? base 64?

By the way thanks for sharing this code. It will be very useful to me.

I believe it uses base64

greate job. thanks.

Why shouldn’t we encrypt/decrypt data with AES on client side only, do not care about PHP or server side? So we will have data encrypted not only on the fly but also in the database.

Sure you can, it all depends on what you need to accomplish on the server-side if decryption is necessary.

Great post. I have a stupid question how can I download php files ? Those are not included in archive
ex.

“I hope this is sunshine on a rainny day for someone out there…”

THANK YOU!

I’m having problem with sending crypted JSON objects to AMFPHP – in random cases the crypted string contains a newline character ‘\n’ which ruins decryption on the server side. Have you ever experienced that? Any ideas how to fix it?

hi, awesome post – very informative! interesting how often ports of the mentioned JS implementation are leading to the desired results.

Just shortly before I was giving up on as3crypto I got it running with following setup using PHP’s mcrypt:

AES (flash) / RIJNDAEL (php) 128bit ECB mode with a 16 characters key. Didn’t try with different settings though, after that proved to be working.
(Note that a “manual” pkcs5 unpadding is necessary in PHP to avoid garbage trailing the decrypted message: )

Coming to 256bit with differing key lengths I’ll be better of with your implementation I presume. Thanks!

here’s another good read about using AES 256 bit in PHP if really needed and that AES/Rijndael 128bit are the same but with 256bit aren’t:

Hello Shane !

Very usefull post, so I decided to download & test your AES Class.

I have an error in utf8 encode method but I don’t know how to fix it… Any idea ?

TypeError: Error #1009: Il est impossible d’accéder à la propriété ou à la méthode d’une référence d’objet nul.
at Utf8$/encode()
at rafarel.utils::AES$/encrypt()

Error fixed, it was not your code.
Sorry, again great job !

welcome