encrpyt salary data

[ljb]

Anyone have a good idea for encrypting salary data in US $? I have an Access
database with some salary info connected to ASP on our intranet. My manager
is somewhat apprehensive about the level of security currently provided. I'm
using basic authentication (I think that's what it is called). It relies on
NT directory permissions and code to query "AUTH_USER" . Does anyone have a
simple encryption idea that can take US$, 5 digit employee ID, encrypt it
and store it in Access' Currency data type? The database will store the
salary encrypted. When an authorized user hits the ASP it will display
decrypted values. All data maintenance is done with various ASP which must
be able to do the encryption/decryption by vbscript.

thanks
LJB

[ljb]

The majority here are Civil Engineers as are all the managers. They are
quite confident in whatever they do. In their opinion end user development
is just fine. They also believe IS projects are always late, over budget and
short on promised functionality.

"Aaron Bertrand - MVP" <aa***@TRASHasp faq.com> wrote in message
news:uw******** ******@TK2MSFTN GP12.phx.gbl...

then send them back to their desk with instructions
to procreate.

Geez, we can get fired around here for that. :-)

[ljb]

I picked the RC4 algorithm. Do you know if the encrypted string generated by
RC4 can be stored in an Access string type field? Not all characters in the
encrypted string are printable. Do Select and Insert handle these properly?

thanks
LJB

[Aaron Bertrand - MVP]

I think we have a different perception of the term "procreate" :-)
"ljb" <.> wrote in message news:uD******** ******@TK2MSFTN GP11.phx.gbl...

The majority here are Civil Engineers as are all the managers. They are
quite confident in whatever they do. In their opinion end user development
is just fine. They also believe IS projects are always late, over budget and short on promised functionality.

"Aaron Bertrand - MVP" <aa***@TRASHasp faq.com> wrote in message
news:uw******** ******@TK2MSFTN GP12.phx.gbl...

then send them back to their desk with instructions
to procreate.

Geez, we can get fired around here for that. :-)

[Aaron Bertrand - MVP]

> I picked the RC4 algorithm. Do you know if the encrypted string generated
by

RC4 can be stored in an Access string type field? Not all characters in the encrypted string are printable. Do Select and Insert handle these

properly?

Well, you could always try it.

[Chopper]

"ljb" <.> wrote in message news:%2******** **********@TK2M SFTNGP09.phx.gb l...

I picked the RC4 algorithm. Do you know if the encrypted string generated by RC4 can be stored in an Access string type field? Not all characters in the encrypted string are printable. Do Select and Insert handle these properly?
thanks
LJB

You shouldn't have a problem storing it in a field of type 'text' providing
the ciphertext doesn't exceed 255 characters.
The only character you will have problems with is the apostrophe. Here's
some info:
http://www.aspfaq.com/show.asp?id=2035

chopper

[Jeff Cochran]

On Mon, 17 Nov 2003 10:26:15 -0600, "ljb" <.> wrote:

The majority here are Civil Engineers as are all the managers.
Around here we'd prefer that neither engineers nor managers be allowed
to procreate... :)
"Aaron Bertrand - MVP" <aa***@TRASHasp faq.com> wrote in message
news:uw******* *******@TK2MSFT NGP12.phx.gbl.. .

> then send them back to their desk with instructions
> to procreate.

Geez, we can get fired around here for that. :-)

[Arnold Shore]

Here's what I did with that particular problem at a gov't site with
international users. (This may sound complex, but it really isn't, and
worked out very nicely. It also got us blessed in a stringent security
review.)

Let me note that the problem in encryption is the problem of key management.
Therefore, I built the solution around the use of public key crypto.

1. In this approach, the user's password is the private key. We don't
store that, but rather its hash, for login authentication.
2. At login, that private key is carried in a form field to the script
doing the lookup, decrypt, and display.
3. The public key, calculated from the password/private key, is used by the
data load script for encryption. It's perfectly secure to retain this
public key in the database, since the private key, the user's password,
can't be derived from it.

What's stored in the database? Only the public key, which is universally
considered safe for publication, and an MD5 hash of the public key, also
safe. Secondly, the salary info is secure from what's widely known to be
the bigtime risk, the insider. And thirdly, even if one password is broken,
all the others remain secure.

I used a very nice COM product for this: see it at www.dyncrypto.com Quite
inexpensive, good sample scripts, and easy to use.

AS

[Arnold Shore]

Correction: That " ...MD5 hash of the public key ... " should be "MD5 hash
of the PRIVATE key", the user's password.

AS

[Don Grover]

Send Me an email and I pass a function onto you, .
su*****@assoft. com.au

"ljb" <.> wrote in message news:ur******** *****@TK2MSFTNG P12.phx.gbl...

Anyone have a good idea for encrypting salary data in US $? I have an Access database with some salary info connected to ASP on our intranet. My manager is somewhat apprehensive about the level of security currently provided. I'm using basic authentication (I think that's what it is called). It relies on NT directory permissions and code to query "AUTH_USER" . Does anyone have a
simple encryption idea that can take US$, 5 digit employee ID, encrypt it
and store it in Access' Currency data type? The database will store the
salary encrypted. When an authorized user hits the ASP it will display
decrypted values. All data maintenance is done with various ASP which must
be able to do the encryption/decryption by vbscript.

thanks
LJB

[ljb]

Thanks, but I have already found and implemented something based on RC4
encryption. The function I used came from
http://www.Planet-Source-Code.com/vb...=6646&lngWId=4

"Don Grover" <sp******@assof t.com.au> wrote in message
news:Or******** ******@TK2MSFTN GP09.phx.gbl...

Send Me an email and I pass a function onto you, .
su*****@assoft. com.au