List of MivaScript builtin functions and discussion thereof

[wmgilligan]

Re: List of MivaScript builtin functions and discussion thereof

Just wanted to say thanks to burch. This is a great resource.
bill

[mvmarkus]

Re: List of MivaScript builtin functions and discussion thereof

Just wanted to say thanks to burch. This is a great resource.
bill

I double this, however would like to add a big thanks to Kent, too, for asking the right questions.

Markus

[mvmarkus]

Re: List of MivaScript builtin functions and discussion thereof

Hi Burch,

Is there a chance that all those very useful things that you wrote here could one day make it into the official Mivascript reference documents (PDF/html)?

Thanks,

Markus

[Rick - Wolfpaw Hosting]

Re: List of MivaScript builtin functions and discussion thereof

OK I have messed with this all night and it is time to ask for help.

I am woking on a module that needs to pass encrypted data to an external application.

I have never tried to use RSA Encryption before but from what I have been able to puzzle out is that first you have to create a key pair.

I was able to create my RSA key pair with no problem.

Then you encrypt the data using the private key and give the public key to whoever is on the receiving end to allow them to decrypt it.

I am trying to encrypt the data using the rsa_private_encrypt function. However it appears that I have to load the key into memory to use it and that is where I am running into problems.

I see that to use the rsa_load_privatekey function I have to supply the pass phrase. As recommended in previous posts I am not storing the pass phrase.

So the question is how do I load the private key into memory and encrypt the data using the private key without having to supply the pass phrase.

[burch]

Re: List of MivaScript builtin functions and discussion thereof

Our builtin functions won't let you generate an RSA keypair without encrypting the private key with a passphrase.

Once you've generated the keypair (with a passphrase at least 4 characters long), you can use the openssl tool to decrypt the private key. From a UNIX shell, run "openssl pkcs8", paste in the encrypted RSA private key, enter the passphrase, and it will output an unencrypted private key which you can then use with MivaScript. When loading the unencrypted private key, just pass '' for the passphrase to rsa_load_privatekey() or rsa_load_privatekey_mem().

Ultimately, there's not much difference between having an unencrypted private key on the server somewhere or an encrypted private key with the passphrase stored nearby, so be aware that you're creating a single point of failure for your encryption system.

[yanping]

Re: List of MivaScript builtin functions and discussion thereof

Hello, Burch

Can I ask whether I get the encrypted private key?

I checked table S01_Encryption, it only stored public key

Thank you

[burch]

Re: List of MivaScript builtin functions and discussion thereof

In PR7, the private keys are stored in sNN_PrivateKeys, which may or may not be in a separate database.

Further, the private keys are encrypted with a hash of the user's entered passphrase and an application key, so you will not be able to decrypt them.

The only way to access the encrypted data post-PR7 is to use our API to decrypt the data on an OrderPayment by OrderPayment basis.

[yanping]

Re: List of MivaScript builtin functions and discussion thereof

Thank you very much, burch. Really great to have new insight when I feel so stuck.

By further search I found the APi method Decrypt_OrderPayment
http://www.offline.org/~burch/mm5_ap...c33a1a7f17ca7f
It may be a silly question, how do I define the variable OrderPayment?
I tried the following code:
<MvAssign Name="l.OrderPayment::order_id" value = "{1084}">
<Mvif expr = "{ [l.Cryptofile ].Decrypt_OrderPayment('test',l.orderpayment,l.pass phrase,l.data) }">
<MvEval expr = "{ l.data }">
<MvEval expr = "{'OK' }">
<mvelse>
<MvEval expr = "{'NOT OK' }">
</MvIF>
it returned 1 (displayed 'OK'), but l.data is empty.

[burch]

Re: List of MivaScript builtin functions and discussion thereof

You should load it out of the database using our API functions. OrderPaymentList_Load_Order or OrderPayment_Load_ID would be good places to start.

[yanping]

Re: List of MivaScript builtin functions and discussion thereof

Thanks burch

[yanping]

Re: List of MivaScript builtin functions and discussion thereof

I have another question. I was able to decrypt the payment data. I would like to encrypt the payment data again with rsa_public_encrypt (using another pair of our own RSA keys not stored in the database, I have the private key and public key in pem format).

I am having problem at:
<MvIF EXPR = "{ rsa_load_publickey_mem( l.encryption:pub_key, l.rsa ) }">
</MvIF>
When I assign a value to l.encryption:pub_key, function 'rsa_load_publickey_mem' will fail. The value I assigned is PEM format of RSA public key, '-----BEGIN RSA PUBLIC KEY----- MIGHAoGBALbBsX5oCV/RX/oVmMvy1J8cnG19vHGVJvHpL32r+O5sRzG0COfVGgtP........ ....ER -----END RSA PUBLIC KEY'

I also made a public key file call '2RsaPub.pem', tried rsa_load_publickey( l.publicketpemfile, l.rsa ), but it failed too

Thanks...

[yanping]

Re: List of MivaScript builtin functions and discussion thereof

After a lot of trying, can I assume the following statement is correct?

Miva RSA Encryption Function only works for Miva generated RSA Keys (Which I will not be able to extract the clean/unencrypted private key to decrypt offline)

[Bruce - PhosphorMedia]

Re: List of MivaScript builtin functions and discussion thereof

Any chance we could get an updated version of MvCall that would essentially ignore HTML errors? MvCall is pretty strict when it comes to parsing HTML, but a lot of times, we don't really care, we are just trying to get the content in a structured manner. So, would be cool to have an Ignore Parsing Error flag.

[burch]

Re: List of MivaScript builtin functions and discussion thereof

Any chance we could get an updated version of MvCall that would essentially ignore HTML errors? MvCall is pretty strict when it comes to parsing HTML, but a lot of times, we don't really care, we are just trying to get the content in a structured manner. So, would be cool to have an Ignore Parsing Error flag.

Funny you should mention that. The exact same subject came up in an internal developer discussion today, and has been placed on the list for a future version of the software. In the meantime, is there a reason the wget() or wdownload() builtin functions wouldn't work for you?

[Bruce - PhosphorMedia]

Re: List of MivaScript builtin functions and discussion thereof

Funny you should mention that. The exact same subject came up in an internal developer discussion today, and has been placed on the list for a future version of the software. In the meantime, is there a reason the wget() or wdownload() builtin functions wouldn't work for you?

Yes, we still need to parse through the file element by element.