dev-cpp-users

[Dev-C++] Simple encryption/obfuscation

[Ed C. <em...@to...>]

Hello all,

I need help on an algorithm. I need to accept username/password =
combinations
on the client side of a client-server app, store those on the client =
side,
and "decrypt" them again without user input, using only the stored =
strings.
Think the "remember my password" function in MS Outlook, IE, etc.

Ideally, I would like to do this:
On first run:
1) Accept email address
2) Accept username & password pairs
3) "Encrypt" username/password pairs with email address + some
machine-dependent data as a key
4) Write these encrypted pairs and the email address to a text file

On future runs:
1) Read the encrypted pairs
2) "Decrypt" them
3) Do stuff.

The best idea I have now is some block-and-bit chunking and shifting - =
break
the string to encrypt into variable-length chunks, shuffle, reassemble, =
bit
rotate, repeat. The "decrypt" would simply reverse the process. My =
concern
is that anybody who knows the algorithm will be able to reverse it quite
easily, given access to the text file.

Any help is appreciated!

-Ed

Re: [Dev-C++] Simple encryption/obfuscation

[David M. <ci...@ya...>]

By definition of your problem anyone who know your algorithm is going
to be able to decrypt the file. Essentially a hacker has all the info
they need if they get their hands on the algorithm and the file that
has both the e-mail and the encrypted data. 

Including a bit of randomness is not going to be easy to do as you
have to somehow rember that random value for you to decrypt it every
time. 

Possibly hide the encrypted data in a file with some other data. And
maybe store the e-mail seperate from the encrypted data. Make it
harder for a hacker to get the data they want, this assumes that a
potential hacker already knows the algorithm.

Hope This Helps
David McKen

--- Ed Cottrell <em...@to...> wrote:
> Hello all,
> 
> I need help on an algorithm. I need to accept username/password
> combinations
> on the client side of a client-server app, store those on the
> client side,
> and "decrypt" them again without user input, using only the stored
> strings.
> Think the "remember my password" function in MS Outlook, IE, etc.
> 
> Ideally, I would like to do this:
> On first run:
> 1) Accept email address
> 2) Accept username & password pairs
> 3) "Encrypt" username/password pairs with email address + some
> machine-dependent data as a key
> 4) Write these encrypted pairs and the email address to a text file
> 
> On future runs:
> 1) Read the encrypted pairs
> 2) "Decrypt" them
> 3) Do stuff.
> 
> The best idea I have now is some block-and-bit chunking and
> shifting - break
> the string to encrypt into variable-length chunks, shuffle,
> reassemble, bit
> rotate, repeat. The "decrypt" would simply reverse the process. My
> concern
> is that anybody who knows the algorithm will be able to reverse it
> quite
> easily, given access to the text file.
> 
> Any help is appreciated!
> 
> -Ed
> 
> 
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by: Perforce Software.
> Perforce is the Fast Software Configuration Management System
> offering
> advanced branching capabilities and atomic changes on 50+
> platforms.
> Free Eval! http://www.perforce.com/perforce/loadprog.html
> _______________________________________________
> Dev-cpp-users mailing list
> Dev...@li...
> TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm
> https://lists.sourceforge.net/lists/listinfo/dev-cpp-users


=====
Signed 
David Mcken

Life Sucks
Live with it

__________________________________
Do you Yahoo!?
Yahoo! Hotjobs: Enter the "Signing Bonus" Sweepstakes
http://hotjobs.sweepstakes.yahoo.com/signingbonus

RE: [Dev-C++] Simple encryption/obfuscation

[Ed C. <em...@ed...>]

Hi David (and Reid),

I should be more careful with my wording; the "server" side is actually =
a
database server. This is really a database app. Now, I CAN install a
script/app on the primary or secondary server (there are several), but =
what
I really need to do is find some way to secure the database passwords
themselves.

I'm not sure of a good method for doing this, as the client has to have =
the
plaintext passwords to make the connections to the databases. I could
require the user to provide some sort of username and password, of =
course,
but part of the purpose of this program is data-warehousing, meaning =
moving
very large amounts of data between machines; so, I'd like to be able to =
run
it (the update/transfer portion, at least) in off-peak hours, =
automatically.


I'm kind of stuck: the client app has to know how to connect, somehow, =
but I
also need to run the app on off-peak hours, without user input.

So, this is really my question: is there any combination of algorithm =
and
key/salt data which would make it unreasonably difficult to discover the
database connection info, or is that a pipe dream? If not, would =
installing
the update portion as a (automatic/scheduled) server application and the
data mining part on client machines (requiring a username and password =
to
logon) be acceptably secure? What are the pros and cons of this idea?

I should also mention that one of the database systems I have to work =
with
is an old Visual FoxPro system - no, changing that part is not an option =
-
and working with it requires that the clients be on the same LAN as the
server holding the Visual FoxPro files, since FoxPro is not really a =
server.
This LAN is not accessible from outside; security on this project is =
already
a nightmare.

Anyone still reading?

-Ed

=20


-----Original Message-----
From: dev...@li...
[mailto:dev...@li...] On Behalf Of David =
McKen
Sent: Sunday, January 11, 2004 9:35 PM
To: Dev-C Mailing List
Subject: Re: [Dev-C++] Simple encryption/obfuscation


By definition of your problem anyone who know your algorithm is going
to be able to decrypt the file. Essentially a hacker has all the info
they need if they get their hands on the algorithm and the file that
has both the e-mail and the encrypted data.=20

Including a bit of randomness is not going to be easy to do as you
have to somehow rember that random value for you to decrypt it every
time.=20

Possibly hide the encrypted data in a file with some other data. And
maybe store the e-mail seperate from the encrypted data. Make it
harder for a hacker to get the data they want, this assumes that a
potential hacker already knows the algorithm.

Hope This Helps
David McKen

--- Ed Cottrell <em...@to...> wrote:
> Hello all,
>=20
> I need help on an algorithm. I need to accept username/password
> combinations
> on the client side of a client-server app, store those on the
> client side,
> and "decrypt" them again without user input, using only the stored
> strings.
> Think the "remember my password" function in MS Outlook, IE, etc.
>=20
> Ideally, I would like to do this:
> On first run:
> 1) Accept email address
> 2) Accept username & password pairs
> 3) "Encrypt" username/password pairs with email address + some
> machine-dependent data as a key
> 4) Write these encrypted pairs and the email address to a text file
>=20
> On future runs:
> 1) Read the encrypted pairs
> 2) "Decrypt" them
> 3) Do stuff.
>=20
> The best idea I have now is some block-and-bit chunking and
> shifting - break
> the string to encrypt into variable-length chunks, shuffle,
> reassemble, bit
> rotate, repeat. The "decrypt" would simply reverse the process. My
> concern
> is that anybody who knows the algorithm will be able to reverse it
> quite
> easily, given access to the text file.
>=20
> Any help is appreciated!
>=20
> -Ed
>=20
>=20
>=20
>=20
> -------------------------------------------------------
> This SF.net email is sponsored by: Perforce Software.
> Perforce is the Fast Software Configuration Management System
> offering
> advanced branching capabilities and atomic changes on 50+
> platforms.
> Free Eval! http://www.perforce.com/perforce/loadprog.html
> _______________________________________________
> Dev-cpp-users mailing list
> Dev...@li...
> TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm
> https://lists.sourceforge.net/lists/listinfo/dev-cpp-users


=3D=3D=3D=3D=3D
Signed=20
David Mcken

Life Sucks
Live with it

__________________________________
Do you Yahoo!?
Yahoo! Hotjobs: Enter the "Signing Bonus" Sweepstakes
http://hotjobs.sweepstakes.yahoo.com/signingbonus


-------------------------------------------------------
This SF.net email is sponsored by: Perforce Software.
Perforce is the Fast Software Configuration Management System offering
advanced branching capabilities and atomic changes on 50+ platforms.
Free Eval! http://www.perforce.com/perforce/loadprog.html
_______________________________________________
Dev-cpp-users mailing list
Dev...@li...
TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm
https://lists.sourceforge.net/lists/listinfo/dev-cpp-users