Hi.

I'm storing a username/password combination in a .INI file, and I need some
sort of (basic) encryption for storing the Password.
Does anyone have or know of a simple String->EncryptedString function?

I will obviously also need some sort of reverse function.

It doesn't need to be advanced, just something to avoid having the password
in cleartext.

I've looked through the JCL library but couldn't find anything there. I also
looked at the Indy components.

Regards,
--
Tom Reiertsen, Senior Consultant - EDB Business Consulting AS
Phone:+47 55984400 - Mobile: +47 91380657
mailto:tom.reiert...@bdc.no - http://www.edbbc.no/

Wrong newsgroup?

Here you'll find some code by Steve Schafer:

http://www.swissdelphicenter.com/en/showcode.php?id=1243

tom

 > Does anyone have or know of a simple String->EncryptedString function?

The absolute simplest solution would be to XOR each char
to encrypt, and then XOR again to decrypt, that always works.

for i := 1 to Length(Password) do
   Password[i] := Char(Byte(Password[i]) xor 5);

Works both ways. And you can use your imagination to
alter the '5' value, you can use other numbers, you could
use the i value, the byte value of the previous char
etc. etc.

Ingvar Nilsen

news:3d6f1307$1@newsgroups.borland.com...

Yes, I think now that perhaps it was. I apologize.

Thank you very much. This was indeed the kind of information I was looking
for.

Thanks to Ingvar too for his solution.

Tom.

news:3d6f1151$1@newsgroups.borland.com...

It's better to use a hash. There are quite a few free libs on Torry, f.i.
http://www.torry.net/vcl/security/strong/chipher.zip

On Fri, 30 Aug 2002 14:04:10 +0200, Henrick Hellstr?m found a keyboard

Then set up a website telling people to download "crank" (though its for
linux only I think)
see http://crank.sf.net/

;-)

johannes

Steve Schafers code satisfies his requirements.

tom

And what's whrong with that??? All he wanted was just something to avoid
having the password
in cleartext.

Why do all people come pickie when it comes to encryption?

Christian

On Fri, 30 Aug 2002 12:29:16 +0000, Christian Charette found a keyboard and wrote:

Because having it in some kind of ROT mechanism or whatever is equivalent
to having it in clear-text, you only *feel* safer, and IMHO that is the
problem, because people start relying on things like that, when they in
reality cannot.

johannes

 >>not less code. It will only give you what is commonly known as
 >>"protection from your kid sister" (that's actually a semi-technical term
 >>frequently used at sci.crypt <g>), just like Ingvar Nilsen's code.
 >
 >
 > And what's whrong with that??? All he wanted was just something to avoid
 > having the password
 > in cleartext.
 >
 > Why do all people come pickie when it comes to encryption?

Johannes is right. I would like add add another observation: Steve
Schafer has obviously gone to some length implementing his encryption
scheme *despite* the fact that, compared to e.g. ROT, he is only adding
lines of code and nothing but a completely negligle amount of security.

How is that?

To give an analogous example, it would be like replacing a simple Pascal
statement like

     x := y + 5;

with 50 lines of code giving the same final output. No sane programmer
would do that. But when it comes to encryption people insists on trying
- trivially weak encryption in as many lines of code as possible.

--
Henrick Hellstr?m,
StreamSec http://www.streamsec.com
Borland Technology Partner
Need to security enhance your Delphi application? Don't settle for
anything less than StrSecII:
http://www.streamsec.com/prod_strsec2.asp

"John Herbster (TeamB)" <Jo...@petronworld.com> wrote in message
news:3d6f9a7f$1@newsgroups.borland.com...

Standard government procedure --- never let common sense and practicality
get in the way of the bureaucracy.

Yup... Disapointing, isn't it ?

Can I ask what product you used ? I've found many different ones on the web
but I haven't found one that didn't give uneasy feeling about how secure
they are (I tend to be quite badly impressed when a product claims
"absolute security" but doesn't give any details on how it acheive that
goal).

The sad truth is that most users do that. And not only that, but you'll see
that the most commonly used mail client on the planet doesn't even properly
support secure POP3 login :(

Then thanks anyway for having tried :)

Good luck,
Stephane

Ah well, that won't help me much :)
Actually, I could do the same using NTFS disk encryption and a hardware key
but I don't want to encrypt the whole drive (for two reasons: one is
performance, the second is that it would make backup problematic).

But more specifically I was asking which PHYSICAL device you used ;)

Well, SSL/TSL has it's own set of problem (like obtaining a reliable root
certificate or giving in to the Verisign blackmail) but I was actually
thinking of a less secure but still secure enough handshake system:
CRAM-MD5. (If I need security beyond this point, I'd much rather trust a
document encryption system like PGP than a simple connection encryption
system).

Good luck,
Stephane

While you are, in theory correct, in practice you are most of the time
wrong:

1/ I've never seen ANYONE react to a "this SSL certificate is invalid" or
"you don't trust this certificate root" message with more than a shrug and
a "some of them techies must have broken it again".

2/ The number of flaws that is present in your average default
OS/application install is so high that a large majority of the computers
running today are still quite happy to automatically run code of your
choosing with little or no user intervention.

3/ YOUR box might be safe, but how safe is the box of your co-worker, wife
or husband, friend ? Have you ever used your company web mail from a {*word*104}
cafe ? Do you ever connect your laptop to eternal network ? While, in
theory, all of these could be as secure as they should, they, more oftern
than not, are wide open and leaves you vulnerable.

No, I don't think that is is possible to secure a network that is to be
used by a large number of unknowlegable people (i.e. any enterprise). The
best you can hope for is "good enough security".

Oh, I'm pretty confident that my own box is as secure as I can make it and
I'm very touchy about patching it. Same holds for my servers and the
servers I've been asked to "fix" or "check". But I don't expect any of this
to be invulnerable. I know that I'm not the only one with admin rights on
my network. I know that most of the staff here has physical access to the
domains controller and therefore could possibly get a copy of the SAM
database and run it though a decryption tool. I also know that many
machines here haven't been patched for a wile and that, while my anti-virii
are good, they won't prevent one of the bosses from getting a tailored
attack program on his personal laptop and getting rooted. These are the
limits of my security. It would be possible to improve the security, but
the cost wouldn't be realistic with what we have to loose.

In practice, I KOW that someone determined could hack my network and,
sooner or later, hack my box.

Uh ?? Ultimately, you can't create more information that is present in a
password. And if you ask a user for a password, the strength of the
resulting key can only possibly be as long as the number of byte in the
password itself. Everything else (from salt to multiple hash) is doomed to
be defeated in a short while.

And how would you add these bits of information that is both reproductible
by the H(password) function and impossible to guess by an attacker that has
access to the binary code of your program (in wose case) ?

How does that relate ? We're talking about personal security for the mass
here. Crypto hardware is bot much too {*word*118} and much too rare to be
expected in the mass market today. And even these have several fundamental
flaw like: you still need to store their access keys in the host system.

Good luck,
Stephane

You're talking about schemes such as adding a salt value that is unique to
a system but common to all users of that system to the password in order to
defeate pre-computed hash lists, are you ?

Or are you talking about adding lengthy string/bit manipulation to the
derivation process just to slow it down so it takes longer to compute a key
? It could be a valid approach to defeat on-the-spot, blind brute force
attack (that is, attack where the attacker doen't know anything about the
key or the algorithm used to computer it but just tries all possible
password on a "live" interface).

The flaw, of course, is that you need to have some kind of access to that
box in order to receive the uncyphered stuff. And the only way that the
hardware can KNOW you have the right to get that information is that if you,
 somehow, authenticate with it. And in that case, you're back with your
chicken and egg problem: you need to store that authentication information
safely.

Now, if you considere that the machine acessing the CSP is "clean", then
you don't have the need for that CSP anyway, do you ?

But the bottom line is, IMNSHO, that you can protect a server, maybe your
own desktop machine, but you can't could on end-user machine to be fully
protected: dedicated hardware will not solve that problem.

Since this is twice the price of the latest, greatest video card around,
about the same price as a multi-usage printer/scanner/fax/copier or a good
quality flat screen display, this price is WAY too high to be considered
consumer product.

Good luck,
Stephane