Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.programming > #12524

Re: string encryption

Show all headers | View raw

On 29/04/2021 15:40, Malcolm McLean wrote:
> On Thursday, 29 April 2021 at 08:37:29 UTC+1, David Brown wrote:
>> On 28/04/2021 23:33, Malcolm McLean wrote: 
>>> On Wednesday, 28 April 2021 at 20:55:38 UTC+1, Dmitry A. Kazakov wrote: 
>>>> On 2021-04-28 16:27, Malcolm McLean wrote: 
>>>>> What's the best method for cheap and cheerful string encryption, which takes a plaintext string and a short string as a key, and returns a crypted string? The encrypted text must be a string, so the encryption must never create a nul character. It might also be best not to create ascii control characters, or non-ascii characters. 
>>>> Looks like a symmetric encryption to me. Any method would do. E.g. 
>>>> ChaCha20 cipher. Hash the key to initialize. There are plenty 
>>>> implementations of. It is cryptographically strong, computationally 
>>>> fast, needs no padding. 
>>>>
>>> CHaCha20. Hadn't heard of that. That's the sort of idea I'm looking for. 
>>>> If you do not care much about strength, simply use a random generator. 
>>>> Hash the key, use it as the seed. xor generated octets to the 
>>>> characters. Done. 
>>>>
>>> I'm not overly concerned about strength. If we come under attack from a resourceful 
>>> cracker we'll have more things to worry about than these configuration files I'd rather 
>>> protect from manipulation.
>> Are you trying to protect against /manipulation/, or against /reading/ 
>> the configuration files? 
>>
>> If it is just manipulation that is concern, have the file as something like: 
>>
>> # Generated configuration file - do not edit! 
>> [foo] 
>> bar = 123 
>> # Configuration file checksum 0123456789abcdef 
>>
>> The final line is the checksum (md5, sha256, whatever) of all the rest 
>> of the file concatenated with a "secret" keystring.
>>
> The strings are JSON representing the settings for an editing tool. User can
> cache the settings and recall them.  It's user's data, so it's not particularly
> secret. But if he reads the string it's giving him an insight into how the tool
> works, which might be a good thing but might be a bad thing. However I don't
> want him editing the files by hand, seeing what effect it has, and playing with 
> it like that. A checksum might be an alternative solution to encryption.
> 

I'm a fan of letting the user see his/her own data - but that's up to
you.  A checksum here would be a simple and safe way of stopping manual
editing, while keeping the significant benefit of being able to see and
quote the settings (in email, telephone support, etc.).

It also avoids the risk of losing the key and therefore losing all the data.

Back to comp.programming | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

string encryption Malcolm McLean <malcolm.arthur.mclean@gmail.com> - 2021-04-28 07:27 -0700
  Re: string encryption Kristjan Robam <he12457@hotmail.com> - 2021-04-28 08:39 -0700
  Re: string encryption David Brown <david.brown@hesbynett.no> - 2021-04-28 19:58 +0200
    Re: string encryption David Spencer <spencer@panix.com> - 2021-04-28 18:00 +0000
      Re: string encryption David Brown <david.brown@hesbynett.no> - 2021-04-28 20:47 +0200
      Re: string encryption Kristjan Robam <rob999999999@yahoo.com> - 2021-04-29 02:26 -0700
    Re: string encryption Kristjan Robam <ya12983@mail.com> - 2021-04-28 12:14 -0700
    Re: string encryption Malcolm McLean <malcolm.arthur.mclean@gmail.com> - 2021-04-28 14:33 -0700
    Re: string encryption Malcolm McLean <malcolm.arthur.mclean@gmail.com> - 2021-04-28 14:39 -0700
  Re: string encryption "Dmitry A. Kazakov" <mailbox@dmitry-kazakov.de> - 2021-04-28 21:55 +0200
    Re: string encryption Malcolm McLean <malcolm.arthur.mclean@gmail.com> - 2021-04-28 14:33 -0700
      Re: string encryption "Dmitry A. Kazakov" <mailbox@dmitry-kazakov.de> - 2021-04-29 08:06 +0200
        Re: string encryption David Brown <david.brown@hesbynett.no> - 2021-04-29 09:38 +0200
          Re: string encryption "Dmitry A. Kazakov" <mailbox@dmitry-kazakov.de> - 2021-04-29 10:00 +0200
          Re: string encryption Ben Bacarisse <ben.usenet@bsb.me.uk> - 2021-04-29 22:33 +0100
      Re: string encryption David Brown <david.brown@hesbynett.no> - 2021-04-29 09:37 +0200
        Re: string encryption Malcolm McLean <malcolm.arthur.mclean@gmail.com> - 2021-04-29 06:40 -0700
          Re: string encryption David Brown <david.brown@hesbynett.no> - 2021-04-29 17:01 +0200

csiph-web