RE: [Dev-C++] Simple encryption/obfuscation

[Ed C. <em...@ed...>]

Hi David (and Reid),

I should be more careful with my wording; the "server" side is actually =
a
database server. This is really a database app. Now, I CAN install a
script/app on the primary or secondary server (there are several), but =
what
I really need to do is find some way to secure the database passwords
themselves.

I'm not sure of a good method for doing this, as the client has to have =
the
plaintext passwords to make the connections to the databases. I could
require the user to provide some sort of username and password, of =
course,
but part of the purpose of this program is data-warehousing, meaning =
moving
very large amounts of data between machines; so, I'd like to be able to =
run
it (the update/transfer portion, at least) in off-peak hours, =
automatically.


I'm kind of stuck: the client app has to know how to connect, somehow, =
but I
also need to run the app on off-peak hours, without user input.

So, this is really my question: is there any combination of algorithm =
and
key/salt data which would make it unreasonably difficult to discover the
database connection info, or is that a pipe dream? If not, would =
installing
the update portion as a (automatic/scheduled) server application and the
data mining part on client machines (requiring a username and password =
to
logon) be acceptably secure? What are the pros and cons of this idea?

I should also mention that one of the database systems I have to work =
with
is an old Visual FoxPro system - no, changing that part is not an option =
-
and working with it requires that the clients be on the same LAN as the
server holding the Visual FoxPro files, since FoxPro is not really a =
server.
This LAN is not accessible from outside; security on this project is =
already
a nightmare.

Anyone still reading?

-Ed

=20


-----Original Message-----
From: dev...@li...
[mailto:dev...@li...] On Behalf Of David =
McKen
Sent: Sunday, January 11, 2004 9:35 PM
To: Dev-C Mailing List
Subject: Re: [Dev-C++] Simple encryption/obfuscation


By definition of your problem anyone who know your algorithm is going
to be able to decrypt the file. Essentially a hacker has all the info
they need if they get their hands on the algorithm and the file that
has both the e-mail and the encrypted data.=20

Including a bit of randomness is not going to be easy to do as you
have to somehow rember that random value for you to decrypt it every
time.=20

Possibly hide the encrypted data in a file with some other data. And
maybe store the e-mail seperate from the encrypted data. Make it
harder for a hacker to get the data they want, this assumes that a
potential hacker already knows the algorithm.

Hope This Helps
David McKen

--- Ed Cottrell <em...@to...> wrote:
> Hello all,
>=20
> I need help on an algorithm. I need to accept username/password
> combinations
> on the client side of a client-server app, store those on the
> client side,
> and "decrypt" them again without user input, using only the stored
> strings.
> Think the "remember my password" function in MS Outlook, IE, etc.
>=20
> Ideally, I would like to do this:
> On first run:
> 1) Accept email address
> 2) Accept username & password pairs
> 3) "Encrypt" username/password pairs with email address + some
> machine-dependent data as a key
> 4) Write these encrypted pairs and the email address to a text file
>=20
> On future runs:
> 1) Read the encrypted pairs
> 2) "Decrypt" them
> 3) Do stuff.
>=20
> The best idea I have now is some block-and-bit chunking and
> shifting - break
> the string to encrypt into variable-length chunks, shuffle,
> reassemble, bit
> rotate, repeat. The "decrypt" would simply reverse the process. My
> concern
> is that anybody who knows the algorithm will be able to reverse it
> quite
> easily, given access to the text file.
>=20
> Any help is appreciated!
>=20
> -Ed
>=20
>=20
>=20
>=20
> -------------------------------------------------------
> This SF.net email is sponsored by: Perforce Software.
> Perforce is the Fast Software Configuration Management System
> offering
> advanced branching capabilities and atomic changes on 50+
> platforms.
> Free Eval! http://www.perforce.com/perforce/loadprog.html
> _______________________________________________
> Dev-cpp-users mailing list
> Dev...@li...
> TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm
> https://lists.sourceforge.net/lists/listinfo/dev-cpp-users


=3D=3D=3D=3D=3D
Signed=20
David Mcken

Life Sucks
Live with it

__________________________________
Do you Yahoo!?
Yahoo! Hotjobs: Enter the "Signing Bonus" Sweepstakes
http://hotjobs.sweepstakes.yahoo.com/signingbonus


-------------------------------------------------------
This SF.net email is sponsored by: Perforce Software.
Perforce is the Fast Software Configuration Management System offering
advanced branching capabilities and atomic changes on 50+ platforms.
Free Eval! http://www.perforce.com/perforce/loadprog.html
_______________________________________________
Dev-cpp-users mailing list
Dev...@li...
TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm
https://lists.sourceforge.net/lists/listinfo/dev-cpp-users