Encryption/Decryption program - thoughts/feedback?

[Jimmy Russel]

So I did this little thing as part of a bigger project, and while it works correctly, something seems off to me.. I was wondering if you LabVIEW experts wanted to check this out (possibly use it) and tell me any major errors, whether it be poor security practice or just messy wiring. Notes:

- The goal behind this VI in the larger system is to ensure a particular (very small) file can only be modified through a particular program. Not necessarily for general encryption.

- Encryption is TripleDES. The key is hard-coded in because I'm going to password-protect the VIs once they are in use, and its use is limited to a single application for now. If this is unacceptable, please explain why, and if there is a better way to store the key.

- I use .NET classes extensively. While they are quite useful, I've heard that it is bad practice to "mix languages". I think it's okay here since I don't expect this code to run on non-Windows OSes, but if you think otherwise feel free to say so.

VIs are attached. Thanks! Also, if you use these for any other program please give credit where credit is due. Not that I deserve it, haha...

[crossrulz]

I didn't know there was a .NET that did encryption.  I might have to start looking more into .NET for more applications.  You might want to have a look at Ton's encryption code written entirely in G.  It doesn't have TDES, but it's still impressive.

[Darin.K]

---

@Jimmy Russel wrote:

- Encryption is TripleDES. The key is hard-coded in because I'm going to password-protect the VIs once they are in use, and its use is limited to a single application for now. If this is unacceptable, please explain why, and if there is a better way to store the key.

---

I would not rely on VI password protection at all in a security scheme.  You would be better off removing the block diagrams from those VIs.  A bit of a pain, but really a better option.  Even in this case I would not store the key directly but obfuscate it and then reconstruct it inside the code.

I have a few tricks I use, but I do not really share them since their strength is mostly due to their obscurity. 

[crossrulz]

---

@Darin.K wrote:

I have a few tricks I use, but I do not really share them since their strength is mostly due to their obscurity. 

---

Like storing the key in a boolean array? (One of my favorite tricks)

[GregFreeman]

---

@Jimmy Russel wrote:

- The goal behind this VI in the larger system is to ensure a particular (very small) file can only be modified through a particular program. Not necessarily for general encryption.

---

I'm not sure of a better way as I don't work with this kind of thing much, if at all. But, I remember a coworker telling me there is some issue with storing something private as a string constant because if someone were to open the executable (VI?) in a hex editor they may be able to figure out where the key is. I can't remember exacccctly the issue and if it's tied to a VI or a block diagram or both, so take my response with a grain of salt, but I may be able to get back to you in the next couple days with more details.

[Jimmy Russel]

Nice feedback guys.

@cross: Looks good. It has AES which is actually better than TDES in a lot of ways, but given the project I'm hesitant to pull code from "unofficial" sources. Might use it for personal things though.

@Darin K.Security through obscurity? Not really a fan of that. If your system is broken as soon as people know how it works, is it really a good system? I dunno... hopefully your tricks are better than the boolean array one anyway, hehe. 

@for: That's true. I opened it up in a Hex Editor and didn't see anything, but I'm betting the string's in there somewhere.

Maybe I'm reaching for something unreal here. After all, virtually everything where the key is stored with the media gets cracked pretty easily (DVDs, Blu-rays, etc). I could safely assume that this file is NOT nearly important enough to hide the key though, we just don't want any random dude to be able to modify the file. 

[Wart]

There's also an example of Blowfish implemented entirely in G here: http://zone.ni.com/devzone/cda/epd/p/id/3473