Hashing a character string
A user on Informix 7.3 under SCO Unix wanted to obscure passwords stored in a table without changing existing applications, proposing a home-grown hash (multiply each character by its position) done in a trigger/stored procedure, and asked how to do arithmetic on characters to produce new characters. Replies warned that such a fixed scheme is trivially broken and that real encryption raises key-management issues; suggestions were to call the system crypt() library from an ESQL/C program (sample code posted), look at OpenSSL, or wait for built-in encryption expected in a later IDS release. No definitive solution for his setup was agreed.
Auto-generated by DrWatson from the posts below — may be imperfect; read the full thread.
Hi We have Informix 7.3 on SCO Unix. We would like to encrypt a password in an table without having to change the existing applications. The idea is to make use of a simple hashing method, something like: If the current password is 'password' we want to in a trigger and SP convert to p*1 = x1 a*2 = x2 s*3 = x3 s*4 = x4 w*5 = x5 o*6 = x6 r*7 = x7 d*8 = x9 Giving a new password 'x1x2x3x4x5x6x7x8x9' The problem, How to a multiply/add something with a character to give me a new character? Any other suggestions is welcome Thanks David Reed david.reed@compuwin.co.za sending to informix-list
David Reed wrote: > We have Informix 7.3 on SCO Unix. > We would like to encrypt a password in an table without having to change > the existing applications. > > The idea is to make use of a simple hashing method, something like: > If the current password is 'password' we want to in a trigger and SP > convert to > p*1 = x1 > a*2 = x2 > s*3 = x3 > s*4 = x4 > w*5 = x5 > o*6 = x6 > r*7 = x7 > d*8 = x9 > > Giving a new password 'x1x2x3x4x5x6x7x8x9' > > The problem, How to a multiply/add something with a character to give me a > new character? > > Any other suggestions is welcome Strewth, mate! This hasn't been very well thought through, has it? Anybody fancy implementing the DES algorithm as a stored procedure? -- Strewth! Stick a sock in it, Sheila!
David Reed wrote: >Hi > >We have Informix 7.3 on SCO Unix. >We would like to encrypt a password in an table without having to change the >existing applications. > > The idea is to make use of a simple hashing method, something like: > If the current password is 'password' we want to in a trigger and SP >convert to > p*1 = x1 > a*2 = x2 > s*3 = x3 > s*4 = x4 > w*5 = x5 > o*6 = x6 > r*7 = x7 > d*8 = x9 > > Giving a new password 'x1x2x3x4x5x6x7x8x9' > >The problem, How to a multiply/add something with a character to give me a >new character? > >Any other suggestions is welcome > >Thanks >David Reed >david.reed@compuwin.co.za > > >sending to informix-list > > You might want to try this little program (you can make it ESQL/C) that generates a "real" password using the system crypt library (just like the passwd program does) -- I use it to generate passwords for CVS access, but with a little fiddling... #ident "$Id: cvspas.c,v 1.2 2003/03/06 18:09:11 trona Exp $" /* * Stephen G. Kochan & Patrick H. Wood * Topics in C Programming * New York: John Wiley & Sons, Inc., 1991 * Copyright (c) 1991, Stephen G. Kochan and Patrick H. Wood * * The copyright notice above does not * evidence any actual or intended * publication of such source code. */ /* * Name: $Source: /cvsroot/general/cvspas.c,v $ * Purpose: Topics in C Programming * generate passwd for CVS password file * Note: the seed characters are "Kw" (below). * change 'em every year or so... * Version: $Revision: 1.2 $ * Modified: $Date: 2003/03/06 18:09:11 $ * Author: Stephen G. Kochan & Patrick H. Wood * Date: 1991 * $Log: cvspas.c,v $ * Revision 1.2 2003/03/06 18:09:11 trona * minor tuneup * * Revision 1.1 2002/06/20 17:16:29 trona * initial installation of cvspas * */ #include <stdio.h> #include <stdlib.h> #include <pwd.h> #include <time.h> #include <unistd.h> extern char *crypt (const char *, const char *); void main (int argc, char *argv []) { char salt [3]; char *passwd, *encryptedpw; char *user; int i; /* seed the random number generator */ srand ((int) time ((unsigned int) NULL)); /* * we need two random numbers in the range * >= 65 <= 90 or >= 97 <= 122 (that's A - Z * or a - z inclusive) for the salt characters */ while ((i = rand()) < 65 || i > 90 && i < 97 || i > 122) ; salt [0] = i; while ((i = rand()) < 65 || i > 90 && i < 97 || i > 122) ; salt [1] = i; salt [2] = '\\0'; /* find out who we are */ if ((user = getenv ("USER")) == (char *) NULL) { (void) fprintf (stderr, "%s:\\tunable to determine user id\\n", argv [0]); exit (EXIT_FAILURE); } /* ask for the password */ passwd = getpass ("Password to encrypt: "); /* crypt() only looks at the first two characters of salt */ encryptedpw = crypt (passwd, salt); (void) fprintf (stdout, "%s:%s\\n", user, encryptedpw); exit (EXIT_SUCCESS); }
Check out www.openssl.org "David Reed" <david.reed@compuwin.co.za> wrote in message news:cd80n6$pke$1@news.xmission.com... > > Hi > > We have Informix 7.3 on SCO Unix. > We would like to encrypt a password in an table without having to change the > existing applications. > > The idea is to make use of a simple hashing method, something like: > If the current password is 'password' we want to in a trigger and SP > convert to > p*1 = x1 > a*2 = x2 > s*3 = x3 > s*4 = x4 > w*5 = x5 > o*6 = x6 > r*7 = x7 > d*8 = x9 > > Giving a new password 'x1x2x3x4x5x6x7x8x9' > > The problem, How to a multiply/add something with a character to give me a > new character? > > Any other suggestions is welcome > > Thanks > David Reed > david.reed@compuwin.co.za > > > sending to informix-list
David, The problem with a fixed encryption algorithm like this is that it is very easy to break. The problem with a more complex encryption algorithm is that you have to use a 'key' to encrypt and then have to worry about how to save the key and pass the key to the algorithm. M.P. "David Reed" <david.reed@compuwin.co.za> wrote in message news:cd80n6$pke$1@news.xmission.com... > > Hi > > We have Informix 7.3 on SCO Unix. > We would like to encrypt a password in an table without having to change the > existing applications. > > The idea is to make use of a simple hashing method, something like: > If the current password is 'password' we want to in a trigger and SP > convert to > p*1 = x1 > a*2 = x2 > s*3 = x3 > s*4 = x4 > w*5 = x5 > o*6 = x6 > r*7 = x7 > d*8 = x9 > > Giving a new password 'x1x2x3x4x5x6x7x8x9' > > The problem, How to a multiply/add something with a character to give me a > new character? > > Any other suggestions is welcome > > Thanks > David Reed > david.reed@compuwin.co.za > > > sending to informix-list
It's most likely that IDS 9.5 will have this feature standard, but you'll have to change SCO to Linux David Reed wrote: > Hi > > We have Informix 7.3 on SCO Unix. > We would like to encrypt a password in an table without having to change the > existing applications. > > The idea is to make use of a simple hashing method, something like: > If the current password is 'password' we want to in a trigger and SP > convert to > p*1 = x1 > a*2 = x2 > s*3 = x3 > s*4 = x4 > w*5 = x5 > o*6 = x6 > r*7 = x7 > d*8 = x9 > > Giving a new password 'x1x2x3x4x5x6x7x8x9' > > The problem, How to a multiply/add something with a character to give me a > new character? > > Any other suggestions is welcome > > Thanks > David Reed > david.reed@compuwin.co.za > > > sending to informix-list