Securing server to server PHP communication without HTTPS

Question

I have a PHP file which my clients will execute on their server. It constantly communicates with my server. Now, how can I prevent this communication from eaves-dropping and man in the middle attacks without SSL? The reason I do not want SSL is that I am using file_get_contents in the client PHP file to contact server (openSSL/CURL may disabled on client so I am forced to use file_get_contents without SSL).

Thank you for your time and effort.

I don't know, is a [VPN tunnel](http://en.wikipedia.org/wiki/Virtual_private_network) an option? — Jared Farrish, Oct 23 '11 at 14:34
No solution found for this problem yet. I can use only built in PHP functions. May be, some custom made scrambler? Any ideas? — Vishnu, Nov 24 '11 at 13:01

score 2 · Answer 1 · answered Oct 23 '11 at 14:40

2

you can encrypt the sensitive data and decrypt it.

the packets will be visible, but the actual data should be safe.

both servers will need the encryption/decryption keys

answered Oct 23 '11 at 14:40

galchen

5,252
3
29
43

http://stackoverflow.com/questions/1289061/best-way-to-use-php-to-encrypt-and-decrypt – Jared Farrish Oct 23 '11 at 14:44
Yeah, something like OpenSSL: php.net/openssl_public_encrypt – halfer Oct 23 '11 at 15:50

score 0 · Accepted Answer · answered Jul 02 '12 at 11:24

0

Only solution for this problem will be to have a custom built scrambler do the job. I did not wanted to go that far so decided to not transmit any important information and let those communications be done manually.

answered Jul 02 '12 at 11:24

Vishnu

461
3
18

Custom built encryption is the absolute opposite of security. This is creating an interesting puzzle, drawing more attention to your data than you really want/need to. This is putting a big flashing neon sign on your data, with the message "**decrypt me!**" Always, always, always use a well tested, battle hardened encryption system. – Ghedipunk Jun 18 '15 at 18:19

score 0 · Answer 3 · answered Oct 23 '11 at 15:28

To prevent the need for pre-shared private keys, you could also look into a public key option such as GPG which would only necessitate the servers that wish to contact you having your public key, but only you could decrypt the data with your private key. This alleviates the need for a pre-shared private key on both ends of the transaction.

Securing server to server PHP communication without HTTPS

3 Answers3