Re: What *are* the best ways to encrypt data?

So you are sending the password in plain text over the network each time you connect to the db? Apparently, you don't trust your system (otherwise, you wouldn't use the rather pointless "encrypt the password, but have the decryption key on file" technique), so why would you trust your network?
Two things here. First you let your users send their passwords in plain text over the internet. Which already means that there isn't much security. Second, storing the passwords such that they can easily be decrypted is insecure, and not needed. Standard technique is to encrypt the password using a one-way technique (like crypt) and store the encrypted password. When a password comes in, encrypt it, and compare the encrypted passwords.
Digest::MD5 isn't a suitable encryption technique, as this merely creates a hash. It's a one-way function, and you can't go back and retrieve the unencrypted text. To determine what the most suitable technique is, you have to state why you want to encrypt. What do you want to hide against whom? How much time can you spend encrypting/decrypting? How much resources is an attacker willing to employ? Note that security is as weak as its weakest link. There isn't much point in running a "secure OS" which is as hardened as it can be, and using 4096 bit keys if the data you want to protect comes in plain text over the internet, from a virus infected PC.

Comment on Re: What are the best ways to encrypt data?

Replies are listed 'Best First'.
Re^2: What are the best ways to encrypt data? by hardburn (Abbot) on Aug 27, 2004 at 14:50 UTC
Digest::MD5 isn't a suitable encryption technique There are ways to use a hash function as a cipher. IIRC, it involves using the digest as an output-feedback stream cipher. The security of the resulting cipher is based on the security of the hash function (in other words, don't use MD5 for this). Also, keep in mind that the creaters a cryptographic hash function generally don't have in mind its use as a cipher. The only practical use I've been able to find for this is a situation where a government has banned strong encryption software, but not digest functions. In which case a coder can grab an existing digest function and make themselves a strong encryption program. Other than that, you're better off using a real cipher. "There is no shame in being self-taught, only in not trying to learn in the first place." -- Atrus, Myst: The Book of D'ni.	[reply]
Re^3: What are the best ways to encrypt data? by Anonymous Monk on Aug 27, 2004 at 15:30 UTC
The only practical use I've been able to find for this is a situation where a government has banned strong encryption software, but not digest functions. In which case a coder can grab an existing digest function and make themselves a strong encryption program. If a government falls for that, why not just take integer arithmetic and build a strong encryption program from that?	[reply]


good chemistry is complicated, and a little bit messy -LW
	PerlMonks