Encrypting passwords

Hey,

For a program that I'm creating, it is necessary for the user of the program to create a profile, which includes a username and a password. Thing is, the password is being stored in a flat file, so obviously that brings up some security questions.

My question to everybody is this: is there a way to collect user input and (either using an algorithm to encrypt it, or some other way) store it in a file so that another user would not be able to just open the file and see the password?

Thanks!

FlyingIsFun1217

There are many algorithms to encrypt passwords.
But it depends on your application usage to use which one.
For example if you have contract with DOD it should be very secure. Anyway here's an example.
Password is "siavosh"
We have a table that keeps a number for each character.

Code:

---

{a = 3 , b = 33,..., s = 2, o = 112 , i = 25, v = 12, h = 433 }

---

So siavosh will be 2253121122433

It is the simplest possible algorithm and very easy to decrypt for an expert.

[off topic] At last this code tag script has been enabled? What a bad news, what a bad script.

Is the password just the password for the program, or do you need to pass the password onto something else?

If it's local, then all you need to do is create a "hash" of the password (eg. md5) and store the hash in the file.

When you next prompt the user for the password, you hash their input, and compare with the stored hash in the file.

I was thinking something more along the lines of where the password is analyzed letter/number by letter/number, where each letter/number is assigned a different set of numbers or symbols, so that something like 'password' might be turned into 12312932823.

Hash encryption sounds good, but how would I do that? Does that involve the user creating a hash that they need to keep? How would that be in terms of comparing?

Thanks!

FlyingIsFun1217

User selects a password. It will be encrypted and saved somewhere.
Next time user wants to log on, he/she enters a password. This password will be encrypted with exactly the same algorithm of the saved password. Now if they where equal the enter password is correct.

Once I used a loop and a (sin(loop_counter) * loop_counter * hashCode) to encrypt characters. So "d" will be "3" somewhere and "843" somewhere else. These are simple algorithms anyway.

Are there any good in-depth sites that explain these kind of things? I get the concept, now I just need to learn how to code it so that it actually works...

Thanks :)

FlyingIsFun1217

Try googling. It has a link in my sig.

I've been google-ing...

Cant seem to find what I'm looking for :(

Basically, at this point, I would like to do something as simple as collect user text, advance each letter, lets say, 7 times, and save the resulting string.

Are there any sites that have examples of this that are very useful?

Thanks again!

FlyingIsFun1217

I googled and found this.

http://www.mycrypto.net/encryption/e...resources.html

Thank you :)

Mind me asking what search term you used?

Thanks again!

FlyingIsFun1217

Code:

---

#include <string>

void encode(std::string& pass) {

    for (unsigned int i = 0; i != pass.size(); ++i) {
        pass.at(i) += 7;
    }

}

void decode(std::string& code) {

    for (unsigned int i = 0; i != code.size(); ++i) {
        code.at(i) -= 7;
    }

}

int main() {

    std::string strPassword = "flyingisfun1217"

    encode(strPassword);
    decode(strPassword);

}

---

Thank you, that helps a lot, but now that the string has been encrypted, how do you display it? would you use the standard cout<<strPassword ?

Thanks again :)

FlyingIsFun1217
------------------EDIT-------------------

Ok, it does! thanks for the help, from here I'll probably try to do some editing and stuff.

Thanks for all the help!

FlyingIsFun1217

With that method probably not a good idea. What it does is simply move each character down in the ascii table by 7 positions, as you requested. But it may return non-printable characters. You can still cout it, but non printable characters... will not print or have interesting side effects.

Wouldn't that be fine for (in the end) comparing hashes as I determined earlier? Its not that I need to display the encrypted string...

Thanks!

FlyingIsFun1217

But in order to compare, you don't need to display it.

- strPassword stores password
- strUserEnteredPassword stores what password the user attempted
- if (strUserEnteredPassword == strPassword) you give him access.

So using that method, I really shouldn't have any problems, right?

I mean, besides the insecurity (I hope for something this simple to be temporary).

Thanks again!

FlyingIsFun1217

Ok, since I've gotten that to work...

Is there any way to do other math to the string to change its characters? Right now all it does is add and subtract 7, but would it be possible to do other math functions to it to make it just a little more secure?

Thanks again!

FlyingIsFun1217

You will not be making it more secure with a shifting method. No matter how much math you add to it. It will always "shift" the characters on the character table by a given amount.

Search the web for "c++ encryption" if you want to make it any more secure than that.

[QUOTE=FlyingIsFun1217]Ok, since I've gotten that to work...

Is there any way to do other math to the string to change its characters? Right now all it does is add and subtract 7, but would it be possible to do other math functions to it to make it just a little more secure?

Thanks again!

FlyingIsFun1change it by a pattern. For example change it by the fibinachi sequence -- change the first two element by 1, the seccond by 2, the third by 3 ext.

If the file is only used on one computer, you can use random numbers to change it. Then you store the random seed in the file. If use the same random seed and change in the opposite direction you will get your original results back. This always works on the same computer and sometimes works on the same system. This meathod is proveably breakable if the codebreaker does not discover the seed, and the numbers are truely random.

Simmilarly, you could create your own list of random numbers that come with the program. That would make the pervious option portable across computers. This would also allow you to use sites like random.org to generate true random numbers. The problem with this aproach is that the list or random numbers needs to be very long, and therefore the file must be very large. Otherwise a user could apply every possible seed to decrypt your program.

Back to option two, instead of storing the seed in the file, you could store it in the Windows Registry. This is a bit more complex, but it will make it very hard to decrypt your data.

EDIT: For some reason(Mario F.'s last post) I thought you were using a bitwise shift. I changed this post to accomidate any kind of reversible change. Change can mean mean adding a number, using a bitwise rotation, XOR, and many other functions.

As Mario F. said, applying more than one of these functions on a single number, will not make the encryption more secure, unless the function is very easy to guess.

hashing is probably your best bet.

take a look at MD5 and SHA on wikipedia:

http://en.wikipedia.org/wiki/MD5
http://en.wikipedia.org/wiki/SHA-1

for examples of implementations in C++ search the forums for MD5 and SHA, I know for a fact that there are a few good examples posted here.

I suspect the OP will get confused at any possibility beyond what King Mir alreay provided. He will probably learn more by trying his suggestions.

I suspect even suggesting a Xor algorithm will confuse our friend. I don't want to sound pretentious. But its probably best if he takes baby steps.

I agee there is little point in showing him xor. The only advantage of using xor in this case is that the generated text looks more alien. But that's a misleading, because it would still be equally dificult to decrypt.

A better aproach would be to use a look up table. Kind of like what siavoshkc suggested, exept his example does more than he said it does, and is therefore not applicable.

Thanks to all for your help, I am currently looking into the problem, and since I am using wxWidgets to create the GUI, I may want to look into something with that...

FlyingIsFun1217 :)

Quote:

---

Mind me asking what search term you used?

---

Sorry for late answering. It was "password encryption (algorithm)" I think.