Mission: Difficult [encrypt/obfuscate 9-digit SSN into 20 chars or less]

[Drebin]

It's a long story really, but the bottom line is we need to encrypt or
obfuscate a clear-text 9-digit SSN/taxpayer ID into something less than 21
characters. It doesn't need to be super-secure, just something that isn't
plain-text and it HAS to be as unique as the original number. It also does
not need to be a symmetric algorithm - we are using this as a way to create
a unique "userid" on a system to which we single-signon. So it's used
programmaticall y only.

DES/3DES/RC2 are 24 characters, MD5 is 24 (I think?) and SHA1 is 40 - so
those are out

So then, I was just going to do an XOR "encryption " (and I use that word
lightly) - but you'd have to use a second unique value, for each SSN - to
not have this become basically a character swap. In other words, if I use
one "key", then "9" always translates to A - for ALL SSN's.. which is bad,
because it's very easy to pick out the pattern.

SO.. anyone have any ideas of how to mangle up a 9-digit SSN in 20 chars or
less?? Maybe I'm overthinking the problem somehow?

[Dennis Myrén]

I guess ROT[BASE] is to simple?

--
Regards,
Dennis JD Myrén
Oslo Kodebureau
"Drebin" <th*******@hotm ail.com> wrote in message
news:7k******** ***********@new ssvr31.news.pro digy.com...

It's a long story really, but the bottom line is we need to encrypt or
obfuscate a clear-text 9-digit SSN/taxpayer ID into something less than 21
characters. It doesn't need to be super-secure, just something that isn't
plain-text and it HAS to be as unique as the original number. It also does
not need to be a symmetric algorithm - we are using this as a way to
create
a unique "userid" on a system to which we single-signon. So it's used
programmaticall y only.

DES/3DES/RC2 are 24 characters, MD5 is 24 (I think?) and SHA1 is 40 - so
those are out

So then, I was just going to do an XOR "encryption " (and I use that word
lightly) - but you'd have to use a second unique value, for each SSN - to
not have this become basically a character swap. In other words, if I use
one "key", then "9" always translates to A - for ALL SSN's.. which is bad,
because it's very easy to pick out the pattern.

SO.. anyone have any ideas of how to mangle up a 9-digit SSN in 20 chars
or
less?? Maybe I'm overthinking the problem somehow?

[Nicholas Paldino [.NET/C# MVP]]

Drebin,

You could always use the MD5 hash algorithm (using the MD5 class or the
MD5CryptoProvid er in the System.Security .Cryptography namespace. This will
produce a 128 bit hash code, which you can store in 8 unicode characters.

Hope this helps.

--
- Nicholas Paldino [.NET/C# MVP]
- mv*@spam.guard. caspershouse.co m

"Drebin" <th*******@hotm ail.com> wrote in message
news:7k******** ***********@new ssvr31.news.pro digy.com...

It's a long story really, but the bottom line is we need to encrypt or
obfuscate a clear-text 9-digit SSN/taxpayer ID into something less than 21
characters. It doesn't need to be super-secure, just something that isn't
plain-text and it HAS to be as unique as the original number. It also does
not need to be a symmetric algorithm - we are using this as a way to
create
a unique "userid" on a system to which we single-signon. So it's used
programmaticall y only.

DES/3DES/RC2 are 24 characters, MD5 is 24 (I think?) and SHA1 is 40 - so
those are out

So then, I was just going to do an XOR "encryption " (and I use that word
lightly) - but you'd have to use a second unique value, for each SSN - to
not have this become basically a character swap. In other words, if I use
one "key", then "9" always translates to A - for ALL SSN's.. which is bad,
because it's very easy to pick out the pattern.

SO.. anyone have any ideas of how to mangle up a 9-digit SSN in 20 chars
or
less?? Maybe I'm overthinking the problem somehow?

[Tim Gallivan]

I've done this before: randomly generate a one-time pad each type you need
to encrypt, use it to encrypt your characters, break up the pad into single
characters and stick it inside the encrypted string along with dummy
characters. Your decryption code will know the pad and what to decrypt. You
can vary this by changing the order of the pad and/or the data, by using
other dummy values. It all depends on how secure you need to be.

"Drebin" <th*******@hotm ail.com> wrote in message
news:7k******** ***********@new ssvr31.news.pro digy.com...

It's a long story really, but the bottom line is we need to encrypt or
obfuscate a clear-text 9-digit SSN/taxpayer ID into something less than 21
characters. It doesn't need to be super-secure, just something that isn't
plain-text and it HAS to be as unique as the original number. It also does
not need to be a symmetric algorithm - we are using this as a way to create a unique "userid" on a system to which we single-signon. So it's used
programmaticall y only.

DES/3DES/RC2 are 24 characters, MD5 is 24 (I think?) and SHA1 is 40 - so
those are out

So then, I was just going to do an XOR "encryption " (and I use that word
lightly) - but you'd have to use a second unique value, for each SSN - to
not have this become basically a character swap. In other words, if I use
one "key", then "9" always translates to A - for ALL SSN's.. which is bad,
because it's very easy to pick out the pattern.

SO.. anyone have any ideas of how to mangle up a 9-digit SSN in 20 chars or less?? Maybe I'm overthinking the problem somehow?

[Jon Skeet [C# MVP]]

Drebin <th*******@hotm ail.com> wrote:

It's a long story really, but the bottom line is we need to encrypt or
obfuscate a clear-text 9-digit SSN/taxpayer ID into something less than 21
characters. It doesn't need to be super-secure, just something that isn't
plain-text and it HAS to be as unique as the original number. It also does
not need to be a symmetric algorithm - we are using this as a way to create
a unique "userid" on a system to which we single-signon. So it's used
programmaticall y only.

DES/3DES/RC2 are 24 characters, MD5 is 24 (I think?) and SHA1 is 40 - so
those are out

So then, I was just going to do an XOR "encryption " (and I use that word
lightly) - but you'd have to use a second unique value, for each SSN - to
not have this become basically a character swap. In other words, if I use
one "key", then "9" always translates to A - for ALL SSN's.. which is bad,
because it's very easy to pick out the pattern.

SO.. anyone have any ideas of how to mangle up a 9-digit SSN in 20 chars or
less?? Maybe I'm overthinking the problem somehow?

Firstly, you need to get the terminology precise - do you mean 20
characters, or 20 bytes? Are the 9 digits just that - digits, 0-9 (and
therefore representable as 5 bytes)?

DES will encrypt 5 bytes (or more easily, 8 bytes) into 8 bytes, and
then you could use base-64 to go from that to a 12 character form.

Here's some sample code to do just that. Note that it will encrypt
"000123" in the same way as "00123" (and decrypt them both as "123").
If that's a problem, you'll need to think of a slightly different way
of going from the ID to a long, but I'm sure it'll be doable.
using System;
using System.IO;
using System.Security .Cryptography;

class Test
{
static void Main()
{
// In real code you'd need to set an IV and Key to be the same
// thing each time, of course
DESCryptoServic eProvider csp = new DESCryptoServic eProvider();
string encrypted = Encrypt (csp, "123456789" );

Console.WriteLi ne ("Encrypted version: {0}", encrypted);

string plain = Decrypt (csp, encrypted);
Console.WriteLi ne ("Plain text: {0}", plain);
}

static string Encrypt(DESCryp toServiceProvid er csp, string plain)
{
long number = long.Parse(plai n);
byte[] bytes = BitConverter.Ge tBytes(number);
ICryptoTransfor m trans = csp.CreateEncry ptor();

using (MemoryStream ms = new MemoryStream())
{
using (CryptoStream cs = new CryptoStream
(ms, trans, CryptoStreamMod e.Write))
{
cs.Write(bytes, 0, bytes.Length);
cs.Close();
}

return Convert.ToBase6 4String (ms.ToArray());
}
}

static string Decrypt (DESCryptoServi ceProvider csp,
string encrypted)
{
byte[] encryptedBytes = Convert.FromBas e64String(encry pted);

ICryptoTransfor m trans = csp.CreateDecry ptor();

using (MemoryStream ms = new MemoryStream())
{
using (CryptoStream cs = new CryptoStream
(ms, trans, CryptoStreamMod e.Write))
{
cs.Write(encryp tedBytes, 0, encryptedBytes. Length);
cs.Close();
}

byte[] decryptedBytes = ms.ToArray();
if (decryptedBytes .Length != 8)
{
throw new ArgumentExcepti on ("encrypted" ,
"Invalid data");
}
return BitConverter.To Int64(decrypted Bytes, 0).ToString();
}
}
}
--
Jon Skeet - <sk***@pobox.co m>
http://www.pobox.com/~skeet
If replying to the group, please do not mail me too

[Jon Skeet [C# MVP]]

Nicholas Paldino [.NET/C# MVP] <mv*@spam.guard .caspershouse.c om> wrote:

You could always use the MD5 hash algorithm (using the MD5 class or the
MD5CryptoProvid er in the System.Security .Cryptography namespace. This will
produce a 128 bit hash code, which you can store in 8 unicode characters.

It won't be definitely unique though... Admittedly the chances of it
not being unique are tiny, but using a two-way scheme guarantees
uniqueness here.

--
Jon Skeet - <sk***@pobox.co m>
http://www.pobox.com/~skeet
If replying to the group, please do not mail me too

[Drebin]

See inline...

"Jon Skeet [C# MVP]" <sk***@pobox.co m> wrote in message
news:MP******** *************** *@msnews.micros oft.com...

Drebin <th*******@hotm ail.com> wrote:

It's a long story really, but the bottom line is we need to encrypt or
obfuscate a clear-text 9-digit SSN/taxpayer ID into something less than 21 characters. It doesn't need to be super-secure, just something that isn't plain-text and it HAS to be as unique as the original number. It also does not need to be a symmetric algorithm - we are using this as a way to create a unique "userid" on a system to which we single-signon. So it's used
programmaticall y only.

DES/3DES/RC2 are 24 characters, MD5 is 24 (I think?) and SHA1 is 40 - so
those are out

So then, I was just going to do an XOR "encryption " (and I use that word
lightly) - but you'd have to use a second unique value, for each SSN - to not have this become basically a character swap. In other words, if I use one "key", then "9" always translates to A - for ALL SSN's.. which is bad, because it's very easy to pick out the pattern.

SO.. anyone have any ideas of how to mangle up a 9-digit SSN in 20 chars or less?? Maybe I'm overthinking the problem somehow?
Firstly, you need to get the terminology precise - do you mean 20
characters, or 20 bytes? Are the 9 digits just that - digits, 0-9 (and
therefore representable as 5 bytes)?

This is in a database, and then the 20 chars we're send are in an XML doc -
so assume everything is CHARACTERS.

These are standard U.S. social security numbers, so yes - nine digits that
are 0 through 9. What do you mean representable as 5 bytes??
DES will encrypt 5 bytes (or more easily, 8 bytes) into 8 bytes, and
then you could use base-64 to go from that to a 12 character form.

Here's some sample code to do just that. Note that it will encrypt
"000123" in the same way as "00123" (and decrypt them both as "123").
If that's a problem, you'll need to think of a slightly different way
of going from the ID to a long, but I'm sure it'll be doable.

Lemme take a look at this... thanks much!!
using System;
using System.IO;
using System.Security .Cryptography;

class Test
{
static void Main()
{
// In real code you'd need to set an IV and Key to be the same
// thing each time, of course
DESCryptoServic eProvider csp = new DESCryptoServic eProvider();
string encrypted = Encrypt (csp, "123456789" );

Console.WriteLi ne ("Encrypted version: {0}", encrypted);

string plain = Decrypt (csp, encrypted);
Console.WriteLi ne ("Plain text: {0}", plain);
}

static string Encrypt(DESCryp toServiceProvid er csp, string plain)
{
long number = long.Parse(plai n);
byte[] bytes = BitConverter.Ge tBytes(number);
ICryptoTransfor m trans = csp.CreateEncry ptor();

using (MemoryStream ms = new MemoryStream())
{
using (CryptoStream cs = new CryptoStream
(ms, trans, CryptoStreamMod e.Write))
{
cs.Write(bytes, 0, bytes.Length);
cs.Close();
}

return Convert.ToBase6 4String (ms.ToArray());
}
}

static string Decrypt (DESCryptoServi ceProvider csp,
string encrypted)
{
byte[] encryptedBytes = Convert.FromBas e64String(encry pted);

ICryptoTransfor m trans = csp.CreateDecry ptor();

using (MemoryStream ms = new MemoryStream())
{
using (CryptoStream cs = new CryptoStream
(ms, trans, CryptoStreamMod e.Write))
{
cs.Write(encryp tedBytes, 0, encryptedBytes. Length);
cs.Close();
}

byte[] decryptedBytes = ms.ToArray();
if (decryptedBytes .Length != 8)
{
throw new ArgumentExcepti on ("encrypted" ,
"Invalid data");
}
return BitConverter.To Int64(decrypted Bytes, 0).ToString();
}
}
}
--
Jon Skeet - <sk***@pobox.co m>
http://www.pobox.com/~skeet
If replying to the group, please do not mail me too

[Drebin]

Well, it's not necessarily bad - but when this vendor (although it's a
trusted vendor) sees a bunch of (for example, 5 SSN's that start with "011"
for example)

aab******
aab******
aab******
aab******
aab******

type records, they will know it's basically a character replacement.. and
again, they are a trusted vendor, but we'd rather not have our SSN's or an
easily-discoverable version of their SSN available to them.

Thanks though

"Dennis Myrén" <de****@oslokb. no> wrote in message
news:5t******** **********@news 2.e.nsc.no...

I guess ROT[BASE] is to simple?

--
Regards,
Dennis JD Myrén
Oslo Kodebureau
"Drebin" <th*******@hotm ail.com> wrote in message
news:7k******** ***********@new ssvr31.news.pro digy.com...

It's a long story really, but the bottom line is we need to encrypt or
obfuscate a clear-text 9-digit SSN/taxpayer ID into something less than 21 characters. It doesn't need to be super-secure, just something that isn't plain-text and it HAS to be as unique as the original number. It also does not need to be a symmetric algorithm - we are using this as a way to
create
a unique "userid" on a system to which we single-signon. So it's used
programmaticall y only.

DES/3DES/RC2 are 24 characters, MD5 is 24 (I think?) and SHA1 is 40 - so
those are out

So then, I was just going to do an XOR "encryption " (and I use that word
lightly) - but you'd have to use a second unique value, for each SSN - to not have this become basically a character swap. In other words, if I use one "key", then "9" always translates to A - for ALL SSN's.. which is bad, because it's very easy to pick out the pattern.

SO.. anyone have any ideas of how to mangle up a 9-digit SSN in 20 chars
or
less?? Maybe I'm overthinking the problem somehow?

[Drebin]

Jon,

Thanks for your help, but this is what I ran into before (regarding your
code below) - for "12345678", this returns:

Qxrgm9Le6ljQ/seKzR+rbg==

Which is 24 characters.... ???
"Jon Skeet [C# MVP]" <sk***@pobox.co m> wrote in message
news:MP******** *************** *@msnews.micros oft.com...

Drebin <th*******@hotm ail.com> wrote:

It's a long story really, but the bottom line is we need to encrypt or
obfuscate a clear-text 9-digit SSN/taxpayer ID into something less than 21 characters. It doesn't need to be super-secure, just something that isn't plain-text and it HAS to be as unique as the original number. It also does not need to be a symmetric algorithm - we are using this as a way to create a unique "userid" on a system to which we single-signon. So it's used
programmaticall y only.

DES/3DES/RC2 are 24 characters, MD5 is 24 (I think?) and SHA1 is 40 - so
those are out

So then, I was just going to do an XOR "encryption " (and I use that word
lightly) - but you'd have to use a second unique value, for each SSN - to not have this become basically a character swap. In other words, if I use one "key", then "9" always translates to A - for ALL SSN's.. which is bad, because it's very easy to pick out the pattern.

SO.. anyone have any ideas of how to mangle up a 9-digit SSN in 20 chars or less?? Maybe I'm overthinking the problem somehow?

Firstly, you need to get the terminology precise - do you mean 20
characters, or 20 bytes? Are the 9 digits just that - digits, 0-9 (and
therefore representable as 5 bytes)?

DES will encrypt 5 bytes (or more easily, 8 bytes) into 8 bytes, and
then you could use base-64 to go from that to a 12 character form.

Here's some sample code to do just that. Note that it will encrypt
"000123" in the same way as "00123" (and decrypt them both as "123").
If that's a problem, you'll need to think of a slightly different way
of going from the ID to a long, but I'm sure it'll be doable.
using System;
using System.IO;
using System.Security .Cryptography;

class Test
{
static void Main()
{
// In real code you'd need to set an IV and Key to be the same
// thing each time, of course
DESCryptoServic eProvider csp = new DESCryptoServic eProvider();
string encrypted = Encrypt (csp, "123456789" );

Console.WriteLi ne ("Encrypted version: {0}", encrypted);

string plain = Decrypt (csp, encrypted);
Console.WriteLi ne ("Plain text: {0}", plain);
}

static string Encrypt(DESCryp toServiceProvid er csp, string plain)
{
long number = long.Parse(plai n);
byte[] bytes = BitConverter.Ge tBytes(number);
ICryptoTransfor m trans = csp.CreateEncry ptor();

using (MemoryStream ms = new MemoryStream())
{
using (CryptoStream cs = new CryptoStream
(ms, trans, CryptoStreamMod e.Write))
{
cs.Write(bytes, 0, bytes.Length);
cs.Close();
}

return Convert.ToBase6 4String (ms.ToArray());
}
}

static string Decrypt (DESCryptoServi ceProvider csp,
string encrypted)
{
byte[] encryptedBytes = Convert.FromBas e64String(encry pted);

ICryptoTransfor m trans = csp.CreateDecry ptor();

using (MemoryStream ms = new MemoryStream())
{
using (CryptoStream cs = new CryptoStream
(ms, trans, CryptoStreamMod e.Write))
{
cs.Write(encryp tedBytes, 0, encryptedBytes. Length);
cs.Close();
}

byte[] decryptedBytes = ms.ToArray();
if (decryptedBytes .Length != 8)
{
throw new ArgumentExcepti on ("encrypted" ,
"Invalid data");
}
return BitConverter.To Int64(decrypted Bytes, 0).ToString();
}
}
}
--
Jon Skeet - <sk***@pobox.co m>
http://www.pobox.com/~skeet
If replying to the group, please do not mail me too

[Drebin]

Tim, thanks for your help.. I read and re-read, but I don't think I get what
you mean here. Do you have an example or code snippet? And when you say
"encrypt" - using which algorithm??

"Tim Gallivan" <no************ **********@edu. gov.on.ca> wrote in message
news:u%******** ********@TK2MSF TNGP14.phx.gbl. ..

I've done this before: randomly generate a one-time pad each type you need
to encrypt, use it to encrypt your characters, break up the pad into single characters and stick it inside the encrypted string along with dummy
characters. Your decryption code will know the pad and what to decrypt. You can vary this by changing the order of the pad and/or the data, by using
other dummy values. It all depends on how secure you need to be.

"Drebin" <th*******@hotm ail.com> wrote in message
news:7k******** ***********@new ssvr31.news.pro digy.com...

It's a long story really, but the bottom line is we need to encrypt or
obfuscate a clear-text 9-digit SSN/taxpayer ID into something less than 21 characters. It doesn't need to be super-secure, just something that isn't plain-text and it HAS to be as unique as the original number. It also does not need to be a symmetric algorithm - we are using this as a way to

create

a unique "userid" on a system to which we single-signon. So it's used
programmaticall y only.

DES/3DES/RC2 are 24 characters, MD5 is 24 (I think?) and SHA1 is 40 - so
those are out

So then, I was just going to do an XOR "encryption " (and I use that word
lightly) - but you'd have to use a second unique value, for each SSN - to not have this become basically a character swap. In other words, if I use one "key", then "9" always translates to A - for ALL SSN's.. which is bad, because it's very easy to pick out the pattern.

SO.. anyone have any ideas of how to mangle up a 9-digit SSN in 20 chars

or

less?? Maybe I'm overthinking the problem somehow?