Printable View
Hi,
I'm looking to store user account details for email accounts in a client side file. What I need to know is what is best practice to encrypt that information so that its not human readable? Then unencrypt at a later stage.
Also, if you can suggest any libraries that could help me out with this (OpenSSL)?
Thanks
Shiver
Well I can tell you that encryption is the last thing in a long list of security masures. There is at least one person around who can crack whatever encryption you use.
That I already know. :)
I don't expect the password to be safe from everyone, I just dont want it to be human readable to anyone that just happens to open the file with notepad.
Use some library for encryption. Crypto++ for instance, if you are using C++...
As for what kind of encryption you should use, you would have to provide a lot more information about the context in that you wish to hide this data, for anyone to even come close to give you some sound advice.
Like citizen said, encryption alone is little guarantee of security. And you don't even consider the possibility of someone simply wiping your files. Also libraries these days offer the worst and the best of encryption all in the same lib file. You just need to use different functions.
It's mostly really a matter of closing your eyes and pointing. Unless you have a premium concern. Doesn't seem you do, on this instance.
Yeah, I totally get what you guys are saying and you're right, I'm not overly concerned with the encryption that eventually gets used.
It will just be a means of storing a password and then recalling it when the application needs to authenticate, but not making it as obvious as opening it in notepad.
What I was looking at was just Blowfish encryption so that I could unencrypt when needed.
Just wanted to find out (for my simple needs), if that would be considered a good idea or perhaps there is a better way?
If however you have any suggestions/documentation/information which may lead me down the right path to having a "reasonably" secure encryption in other projects, that would be helpful, but not really needed at this point. :)
Thanks for the replies guys...
How about Advanced Encryption Standard? Here's an implementation.
> I'm looking to store user account details for email accounts in a client side file
Sounds just like login to me.
Study how Linux manages logins and do something similar.
In essence, the password is never decrypted, what actually gets compared is
if encrypt(inputPassword) == encryptedStoredPassword then allow login.
You can store the passwords binaricly... this will prevent normal people from reading them and will be easier to use
Whatever non-trivial encryption algorithm you use, it is going to be moderately difficult for the average user to retrieve and relatively simple for an expert with a debugger. So use whatever algorithm is easiest.
I'm not exactly sure how they can make encrypted junk that can never be decrypted, but I guess I could learn if I looked inside the Linux kernel source :). Remember, in any case, Google is your friend.Quote:
In essence, the password is never decrypted, what actually gets compared is
if encrypt(inputPassword) == encryptedStoredPassword then allow login.
A cryptographic hash algorithm is used. Common examples would be MD5 and SHA-1.Quote:
I'm not exactly sure how they can make encrypted junk that can never be decrypted
Thanks guys...
I think I'll probably go with just a binary store for the time being.
Then if I actually keep working on the app and other people use it, I'll do the encryption thing.
At the moment, the app is just for me, so I suppose it doesn't matter much.
I'll definately do the reading tho.
Thanks again.
Remember kids, SHA1 was recently broken. SHA2 hashes to a larger range of values and would probably be harder to bruteforce or collide.
You need to read what the experts actually write. SHA-1 is broken in terms of collision attacks. For a collision attack, the attacker finds two messages that hash to the same hash, but cannot choose the hash output. If the attacker does not know what the original message is, a collision attack does not apply.Quote:
Remember kids, SHA1 was recently broken.