File Encryption

[esa_paranoid]

Hi, I have a password in a program that I allow the user to change. I do this by simply saving the password to file, then calling the password (when needed) from that file.

However, of course anyone can just go onto the hard drive and find the file, and steal the password.

I was curious if anyone has an idea of either how to encrypt the file, or a better way to store the password, or some ideas on how to make this app more secure?


Thanks,
Ryan (7.0)

[ian_fung]

You will love this 🙂

Cheers!

[altenbach]

You also need to worry what should happen if somebody deletes the file ;).

It really depends on your security requirements, bu you definiltey should not store any password in clear text. In fact, you don't need to store the password at all, just the result of some more or less one-way calculation given the password as input.
For example, you could XOR your password with some other known string, rotate the result by the value in the third digit, then take the MD5 of it and store that in the file (or in the registry using the registriy file tools). To verify the password, just see if you get the same result.

Have a look at this wikipedia entry for some other suggestions.

[esa_paranoid]

where are the registry tools located? my security does not have to be super high...just high enough so an average joe can't mess it up 😃

I am looking at this blowfish stuff...hopefully I can find a way to implement it.


The registry idea has really got my attention though, if I can save the password to and read from (and edit) the registry, that is what I would like to do.

Thanks again guys!

Ryan

[esa_paranoid]

I found the registry tools.

I am going to play around with them a bit, if anyone has an example vi they have made of writing to the registry, then reading from the registry that would be great!

Ryan

[Dennis_Knutson]

There are two shipping examples Read From Windows Registry and Write to Windows Registry.

[Enrique]

Check Crypto-G.

Regards;
Enrique

[AmanoGinji]

Nevermind

Message Edited by AmanoGinji on 07-08-2005 01:07 PM

[mikeporter]

To expand on the idea altenbach gave, attached is a copy of a VI I wrote to implement the SHA1 (Secure Hash Algorithm 1). It is used extensively and provides a way of storing things without storing things--if you get my point. When the user creates the password (of any length!) you store away the SHA1 hash of the value (40 characters). To log in the operator enters their password and you again run the SHA1 algorithm against it and if the two hashes match they are in.

According to the RFC defining the algorithm, given a hash, it is "computationally unfeasible" to try and generate another string that produces the same hash.

Mike...

[rolfk]

---

@mikeporter wrote:

According to the RFC defining the algorithm, given a hash, it is "computationally unfeasible" to try and generate another string that produces the same hash.

Mike...

---

I few years ago they said that about MD5 as well :. Nowadays MD5 can only be considered to keep out the curious but definitely isn't a good algorithme to encrypt passwords in high security environments. And dictonary attacks are still a very effective way of cracking even the most complex umptien hundred bits hash encryptions if you have access to the hashs. It is a well known secret that passwords are typically chosen such that they are easily to remember, which most times means not hard to crack.

Rolf Kalbermatter