Editing Secure login (section)

==Crypto routines==
These routines perform encryption and decryption. It is a lightweight version of more sophisticated ones, but (at least I hope) it is sufficient for this application. After the source there are some remarks for those interested.

<div style="padding:4px; background-color: #ffe0e0;border:1px solid #a06060;">'''Warning!''' The secret phrase in the second line should be changed to some secret value. And it should be the same in both copies.</div>
 sub _secret { 
   "Whatever is your secret phrase, give anything here"; 
 }
 sub _intto64 { #a MIME64 type encoding
    my $c=shift;
    $c &=0x3F;
    if($c<10){ return chr(48+$c); }
    if($c<10+26){ return chr($c-10+65); }
    if($c<10+26+26){ return chr($c-10-26+97); }
    if($c==62){ return '_'; }
    return '-';
 }
 sub _encode64 { #encoding three bytes to four chars
    my($a,$b,$c)=@_;
    $a &= 0xFF; $b &= 0xFF; $c &= 0xFF;
    return _intto64($a>>2)._intto64(($a<<4)|($b>>4)).
       _intto64(($b<<2)|($c>>6))._intto64($c);
 }
 sub _from64 { #decoding of the above
    my $c=ord(shift||"0");
    if($c==95){ return 62;}
    if($c==45){ return 63;}
    if($c<48+10){ return $c-48; }
    if($c<65+26){ return $c-65+10; }
    return $c-97+10+26;
 }
 sub _decode64 { # decoding four chars to three bytes
    my($s)=shift;
    my ($r1,$r2,$r3,$r4)=(
       _from64($s),_from64(substr($s,1)),
       _from64(substr($s,2)),_from64(substr($s,3)));
    return ($r1<<18)|($r2<<12)|($r3<<6)|$r4;
 }
 sub _EncodeValue { ## encoded value should not end in a space
    my($id) = @_;
    use Digest::MD5;
    my $salt=substr(Digest::MD5::md5_hex($id, _secret()),0,8);
    my $sstr=Digest::MD5::md5($salt, _secret());
    my $seed=0; my $ssid="";
    for(my $i=0;$i<8;$i++){$seed=($seed<<8)+ord(substr($sstr,$i));}
    srand($seed); my $idlen=length($id);
    $id .= "  "; # pad message by spaces
    for(my $i=0;$i<$idlen;$i+=3){
       #encode $id[0],$id[1],$id[2] as 4 chars
       my $v=rand(0x1000000);
       $ssid .= _encode64(ord(substr($id,$i))^($v>>16),
                          ord(substr($id,$i+1))^($v>>8),
                          ord(substr($id,$i+2))^$v);
    }
    return $salt.$ssid;
 }
 sub _DecodeValue {
    my($s)=@_;
    use Digest::MD5;
    my($salt,$ssid)=(substr($s,0,8),substr($s,8));
    my $sstr=Digest::MD5::md5($salt, _secret());
    my $seed=0;
    for(my $i=0;$i<8;$i++){$seed=($seed<<8)+ord(substr($sstr,$i));}
    srand($seed);
    my $id="";
    for(my $i=0;$i<length($ssid)-3;$i+=4){
        #decode next four chars
        my $v=rand(0x1000000)^_decode64(substr($ssid,$i));
        $id .= chr($v>>16) . chr(0xff&($v>>8)) . chr(0xff&$v);
    }
    $id =~ s/ +$//; ## strip spaces at the end
    # $salt and $chksum should be equal
    $id="" if ($salt ne substr(Digest::MD5::md5_hex($id, _secret()),0,8));
    return $id;
 }
'''Remarks:'''
*The MIME64-like encoding uses letters (both lower and upper case), digits and the characters - (minus) and _ (underscore). These are safe to use in an URL.
*Both encoding and decoding uses MD5 as the building block. The first eight characters of the ciphertext (encoded string) is used for two purposes. First, it acts as a salt, namely it is added to the secret phrase to derive the seed of the random number generator; second it is used to check message integrity, namely it should match the MD5 hash of the message ''and'' the secret phrase.
*Messages to be encrypted (plaintext) should not end by a space (spaces are used to pad the plaintext to have length divisible by three)
*The encryption is deterministic. Such a scheme is insecure in general. In our case, however, the plaintext contains a timestamp, thus - supposedly - the same message is never encrypted twice.
*Weak points of the scheme: only 32 bit MAC (and seed) value, and relying on perl's pseudorandom function.