Re: An Encryption Strategy - Comments Please

From: carion1 (ddavis76_at_gmail.com)
Date: 10/03/05 

Date: Mon, 3 Oct 2005 09:57:12 -0500

If that is a concern then use a secure connection to SQL. 

-- 
Derek Davis
ddavis76@gmail.com
"William Stacey [MVP]" <staceyw@mvps.org> wrote in message 
news:%232ouSQ9xFHA.2516@TK2MSFTNGP12.phx.gbl...
> But now your just passing the password equivilent.  This can be taken off 
> the wire and used just like the clear password if the server is matching 
> it against the same hash.  He needs some form of key exchange or secure 
> stream. Not sure what sql offers in that regard.
>
> -- 
> William Stacey [MVP]
>
> "carion1" <ddavis76@gmail.com> wrote in message 
> news:%23Cn11b6xFHA.612@TK2MSFTNGP10.phx.gbl...
>> Hash the password and pass it to SQL for comparison (this way no need to 
>> decrypt).  You may also want to think twice about using your own custom 
>> security.
>>
>> -- 
>>
>> Derek Davis
>> ddavis76@gmail.com
>>
>> "Diggers" <simonrigby_uk@hotmail.com> wrote in message 
>> news:1128290552.651536.287440@g43g2000cwa.googlegroups.com...
>>> Hello all,
>>>
>>> I posted in this forum not long ago regarding encryption. After some
>>> useful feedback and further reading I have come up with a strategy that
>>> I think will work. I'm interested in feedback and any suggestions. Here
>>> is my scenario.
>>>
>>> Users of my application will interact with data stored in a Sql Server
>>> database. To that end I am also going to maintain the user/password
>>> list in this same database. An administrator will add a new user by
>>> adding a username to this table but leave the password blank.
>>>
>>> When the user logs into the application they will be asked for a
>>> username. If the password for this username is blank in the database, a
>>> known piece of text (for example "this is the key") is encrypted using
>>> DPAPI. They will then be asked to enter a password for their account.
>>> This password will be encrypted using Rijndael using the DPAPI
>>> encrypted known text as the key and stored in the database table.
>>>
>>> At subsequent logins the user enters their username and password. The
>>> DPAPI encrypted key is used to encrypt the password which is compared
>>> against the database table version.
>>>
>>> I think this scenario allows encryption of the database password whilst
>>> not keeping a plain text key on the machine. The known text will of
>>> course be hard coded into the application which I appreciate is subject
>>> to possible reverse engineering. I don't think this is an issue as the
>>> DPAPI encryption is account dependent.
>>>
>>> Any comments on this are extremely welcome.
>>>
>>> Many thanks in advance.
>>>
>>> Simon.
>>> Inverness, Scotland.
>>>
>>
>>
>
>

Relevant Pages

  • Re: Connection to SQL Server CE Windows Service via C# - Error 250
    ... This is probably 3rd time I am hereing to a case the encryption related ... In SQL CE v3.1 case, can you try using Crypto API under the same credentials ... specific to your database or if it's really the password itself. ... connect to it via the windows service under the Local Service ...
    (microsoft.public.sqlserver.ce)
  • Re: RDA and encryption
    ... You can password protect your SQL CE database and/or encrypt the contents ... > on the PocketPC supports any type of encryption? ...
    (microsoft.public.sqlserver.ce)
  • Re: Secure data in SQL Server 2005 Mobile Edition
    ... It turns out that the algorithm used depends on the version of SQL Compact and also what platform it's running on as not all platforms capable of running SQLce support the same encryption. ... how can the database be encrypted with just ...
    (microsoft.public.sqlserver.ce)
  • Re: Ecrypting a database
    ... Windows comes with a native file/folder encryption, ... account would need access to the database to unencrypt the ... >> I have a SQL database which will only be accessed only ...
    (microsoft.public.sqlserver.security)
  • Re: An Encryption Strategy - Comments Please
    ... >> I posted in this forum not long ago regarding encryption. ... >> list in this same database. ... >> adding a username to this table but leave the password blank. ... >> DPAPI encryption is account dependent. ...
    (microsoft.public.dotnet.security)