Password Scheme.

What is the most efficient form of creating a password scheme?
So far, I have seen some examples.
The only method I do not want to use is the array method.
Also, would it be possible to see the code for suggested schemes?
Any help is very much appreciated :)

encryption maybe?

No, what I meant was the best method of password protecting part of your program. Say a function for example.
And if someone could provide code for it :)

Well, for starters, some guidelines:

- Don't store the password in plain text. This can be read and changed by anyone. Store an MD5 hash of the password if you have to
- Don't compare the password (hash) to another one. for instance, don't do:

Code:

---

std::string thehash="thisisahash";
std::string passwd; //read this in later and hash it

...

if(hash(passwd) == thehash)
{
  //now do the function
}

---

This is also easy to change, thus eliminating your security measures.

The best method I can think of is to hash the inputted password, and check if it exists in a web database of valid hashes (and make a maximum request of once per 10 seconds or something, so brute forcing is unrealistic). This has its drawbacks, but if the web database is secure from hackers, it's pretty secure.

passwords are really easy to use. Remember to #include <string>

then do the rest with if and else

Algi, if you merely do...

Code:

---

if(password == "rightpassword")
{
  lettheuserin;
}
else
{
  dontletthemin;
}

---

That's too easy to read. What I think he needs to do is encrypt the password, like apsync said earlier so that the only way to get in is either to know the password, or to use brute force. As Kybo said, having a ten second delay between retries would make brute force impractical, time-wise.

can you read .exe files

No, which is what confuses me about his question.

Could you clarify that for us, WeZ?

Quote:

---

can you read .exe files

---

Yes you just do a hex dump of the exe and all string literals become readily apparent, among other things. Doesn't anyone remember debug from DOS? Anyway these days most development environments will do it for you, providing even a nicer interface than what debug offered.

I don't know if this will point you in the right direction Wez but we have confidential software which encapsulates its functions in dlls that the main program accesses at run time. You open the main program via a starter program which dynamically decryptes the dlls for the main program when the main program links to them.

So to sum up short and sweet:

1. Put your functions you want to protect in a dll(server dll or exe)
2. Encrypt your dll
3. create a interpreter which prompts user for password and starts main program.
4. Have interpreter decrypt dll at link time.
5. When program releases dll at shutdown re-encrypt.

Happy coding!!!!

ill write an example code in a few minutes

EDIT: //there you go

Code:

---

#include <windows.h>
#include <stdio.h>

char plain_password[] = "mypw";
char encrypted_password[] = ",816A";

void encrypt(char string[])
{
        int B,A = sizeof(plain_password);
        for(B=0;B<A;B++)
                string[B] ^= 'A';
}

void decrypt(char string[])
{       
        int B,A=sizeof(encrypted_password);
        for(B=0;B<A;B++)
                string[B] ^= 'A';
}

int main()
{
        encrypt(plain_password);
        printf("plain_password[] is now: %s\n", plain_password);

        decrypt(encrypted_password);
        printf("encrypted_password[] is now: %s\n", encrypted_password);
        return 0;
}

---

if you use this way and if you open the exe with a hex editor or even with notepad, u wont see 'mypw' but ',816A' and they need to know your function to decrypt it

Quote:

---

and they need to know your function to decrypt it

---

Which is ridiculously easy with a disassembler. Especially with that function: just a xor.

Alas, there really aren't very many super-secure solutions.

true, but its ok to start with :D
i think xor was also mine first encryption

else get/read a book about encryption

Here is a little something I whipped up that will demonstrate a simple encryption technique. Simply by applying a XOR mask (using the ^ xor operator), you can encrypt your password, store it in a file and not worry about someone deciphering your password.

With this program, you get only one chance in the beginning to create your password. IF you want to change your password, you will have to exit the program, and physically delete the ciphertext.dat file.

This program is based on this tutorial.

Code:

---

#include<iostream>
#include<fstream>
#include<cstdlib>
#include<cctype>
#include<conio.h>
using namespace std;

int main()   
{

        ifstream in_stream;
        ofstream out_stream;

        char choice;
        char key[10] = "VsRdLwPoAi";        //make an arbitrary private key
        string password;
        string user_entry;                       

        clrscr();       

        in_stream.open("ciphertext.dat");
        if(in_stream.fail())       
        {
                cout << "\nPassword has not been created, would you like "
                    << "to create one now? (Y/N) ";
                cin >> choice;

                if(toupper(choice)=='N')

                        exit(0);
                       
                cout << "\n\nEnter a password (10 characters or less): ";
                cin >> password;
               
                //apply XOR mask encryption
                for(int i=0; i<10; i++)
       
                        password[i] = password[i]^key[i];

                out_stream.open("ciphertext.dat",ios::app);
                if(out_stream.fail())
                {
                        cout << "\a\n\nOutput file opening failed.\n";
                        exit(1);
                }
                           
                //Send encrypted password to file
                out_stream << password;
                       
                out_stream.close();         
        }       
             
        in_stream >> password;        //Retrieve encrypted password from file

        in_stream.close();

        //decrypt password
        for(int i=0; i<10; i++)

                //This second application of XOR will return
                //the password back to original form
                password[i] = password[i]^key[i];

        do{       

                cout << "\n\nEnter your password: ";
                cin >> user_entry;                       

                if(user_entry == password)
                               
                        cout << "\n\nPassword is correct.";

                else

                        cout<< "\a\n\n*** Password incorrect ***";

                cout << "\n\nWould you like to try again? (Y/N) ";
                cin >> choice;

                clrscr();

        }while(toupper(choice)!='N');

return 0;
}

---

I have actually opened the .exe with a hex editor and there is no evidence of the password or private key. Also, I have opened ciphertext.dat with notepad and all I saw was garbled text. XOR'ing a password alone may not be 100% fool-proof, but it is much more secure than using a literal string password. You can use this simple technique as part of a larger scheme. :)

Yes this will encrypt your password but all someone needs to do is get a decompiler and find the key. XOR-ing a password is secure to a layman but even a novice programmer can break it, havent you listened to what people have been saying? XOR is good for encrypting strings with a KEY but the key is stored in your head not on a computer. Wez, good luck with your program if you figure out a good scheme tell me.

Well basically, The Brain's answer summed it all.
Thank-you all who helped in this problem.
I am grateful :)

Quote:

---

I have actually opened the .exe with a hex editor and there is no evidence of the password or private key.

---

I would like to take this opportunity to correct myself.. at first glance while sifting through the hex, I did not see the private key right away.. but I was thinking about this... I recently learned that a null terminated character array should appear as a contiguous block of ascii whilst viewed under the hex editor.. so I decided to take a second look.. and I actually did find the private key.

But man.. unless you really know what you are looking for.. there is nothing that readily jumps out at you that says, "Hey look over here.. I'm a private key..!!" It basically blends in with the surrounding random ascii text. Using a decompiler might make the encryption scheme more visible though.

I was also thinking.. just for fun.. you should make a password using my program.. and send it to all your programmer buddies... and ask them if they can decrypt your password.. and see how many of them can do it. You don't even have to be tricky about it, just make a simple weak password.. tell your friend that you applied a simple encryption scheme... (you can even tell them you XOR'd your password if they can't figure it out right away) and see how many of them can come up with your password. The answer may suprise you. :cool:

This is why you don't encrypt passwords in such a way that they can be decrypted. As Kybo_Ren mentioned, store a hash of the password (somewhere), and compare with the hash. Of course, you have to have somewhere secure to store the valid password hash(es), but that is a detail that you wouldn't need to deal with right away (i.e. store it in the executable or a simple file, etc until your program is up and running).

Some cryptographic hashes I can think of off the top of my head:
- MD5
- RIPE-MD
- Tiger
Google will gladly furnish you with the algorithms (and even C source code) for these.

Cheers

*edit* I was replying to Junior's post.