473,385 Members | 1,867 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 473,385 software developers and data experts.

Where to hide the encryption key

Hi all,
I have a configuration file that is storing sensative data, like db
passwords etc. I want to encrypt the file so that people can not see the
contents. What are the standard practices for storing the encryption key. I
definitely don't want to hard code it in my code otherwise someone looking at
the IL can easily see the key.

Where should this key be stored and how can an app access it without
someone else being able to do the same?

Thanks
Mark.
Nov 23 '05 #1
4 7940
Hi Mark,

Normally one does not store a password in a file, but rather the (salted)
hash of this password. In the main app, when one enters the password, the
hash of this password can be compared with the hash of the password you
calculated and stored in some file. If the hashes are the same, the password
is valid. use SHA256 or better to create the hash.

Hope this helps,

Daniel
Nov 23 '05 #2
Hi Daniel,
thanks for your reply, I definitiely agree with you, however if I need to
store a username and password in my configuration file for a connection
string to the database then I cannot modify that in any way otherwise the
dataabse will not know these values. I need someway to encrypt the
configuration file, but be able to decrypt it to get the connection details
but I am not sure where to store the key which will be used to decrypt the
config file. Do I have to encrypt the encryption key :-) and so on...

Thanks
Mark.

"Daniel" wrote:
Hi Mark,

Normally one does not store a password in a file, but rather the (salted)
hash of this password. In the main app, when one enters the password, the
hash of this password can be compared with the hash of the password you
calculated and stored in some file. If the hashes are the same, the password
is valid. use SHA256 or better to create the hash.

Hope this helps,

Daniel

Nov 23 '05 #3
In my point of view:
1. Put the password's hash into the file;
2. Encrypt rest of contents using the password.
3. When the App starts, first of all compare stored hash and hash of the
entered password, if they are identical - decrypt rest of contents.
Vit
Hi Daniel,
thanks for your reply, I definitiely agree with you, however if I need to
store a username and password in my configuration file for a connection
string to the database then I cannot modify that in any way otherwise the
dataabse will not know these values. I need someway to encrypt the
configuration file, but be able to decrypt it to get the connection details
but I am not sure where to store the key which will be used to decrypt the
config file. Do I have to encrypt the encryption key :-) and so on...

Thanks
Mark.

Nov 23 '05 #4
"Vitaly Zayko" <vitaly_at_zayko_dot_net> wrote in message
news:Om*************@TK2MSFTNGP10.phx.gbl...
In my point of view:
1. Put the password's hash into the file;
2. Encrypt rest of contents using the password.
3. When the App starts, first of all compare stored hash and hash of the
entered password, if they are identical - decrypt rest of contents.
Vit


I think his point here is that there is no "entered" password - there is
only what exists in the config file. AKA - he wants his program to know
what the username/password for the database is, but noone else should be
able to figure it out from the config file. I understand that right? (I
don't know the proper answer to the question - just trying to clarify).

--
Adam Clauss
Nov 23 '05 #5

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

12
by: Mark Buch | last post by:
Hi, is it possible to protect the python sourcecode? I have a nice little script and i dont want to show everbody the source. Im using python on a windows pc. Thank you - Mark
3
by: faktujaa | last post by:
Hi, Currently im storing the connection info. in XML file on the C drive. the only problem with this is that anybody can open and check the database name. I know encryption can solve this problem...
10
by: joshsackett | last post by:
I am starting an encryption project for my database and I'm performing some tests on decryption speed. A lot of my application queries use a LIKE parameter in the WHERE clause. To keep from...
5
by: pinocchio | last post by:
Hello, I want to hide cursor in textRichBox. Default the cursor blink if you click on richTextBox and I want to disable this feature. I need to make something like Adobe Reader, so textRichBox...
1
by: Sharon | last post by:
I’m sending mail form my C#/.NET assembly, and for that I’m doing authentication like that: MailMessage MyMail = new MailMessage()...
10
by: Dica | last post by:
i've got an app that needs to connect to sql server and login with a useName/password. currently, my app saves this info in an XML file in plain text (i.e. no encryption). everytime the app is...
1
by: David | last post by:
One thing that's always puzzled me about implementing encryption on remote asp.net apps is where to store the keys. The demo code indicate that you include them in a configuration file, but this...
2
by: Igor | last post by:
1. Are stored procedures WITH ENCRYPTION slower than the ones without encryption? 2. Should i put most restrictive conditions first or last in WHERE? In which order does MSSQL execute...
7
by: cefrancke | last post by:
I have a few tables with sensitive user information (passwords, etc.) and I would like to prevent someone from opening a blank database and importing those tables. Is there a way to "hide" or...
0
by: taylorcarr | last post by:
A Canon printer is a smart device known for being advanced, efficient, and reliable. It is designed for home, office, and hybrid workspace use and can also be used for a variety of purposes. However,...
0
by: ryjfgjl | last post by:
In our work, we often receive Excel tables with data in the same format. If we want to analyze these data, it can be difficult to analyze them because the data is spread across multiple Excel files...
0
by: emmanuelkatto | last post by:
Hi All, I am Emmanuel katto from Uganda. I want to ask what challenges you've faced while migrating a website to cloud. Please let me know. Thanks! Emmanuel
0
BarryA
by: BarryA | last post by:
What are the essential steps and strategies outlined in the Data Structures and Algorithms (DSA) roadmap for aspiring data scientists? How can individuals effectively utilize this roadmap to progress...
1
by: nemocccc | last post by:
hello, everyone, I want to develop a software for my android phone for daily needs, any suggestions?
1
by: Sonnysonu | last post by:
This is the data of csv file 1 2 3 1 2 3 1 2 3 1 2 3 2 3 2 3 3 the lengths should be different i have to store the data by column-wise with in the specific length. suppose the i have to...
0
by: Hystou | last post by:
There are some requirements for setting up RAID: 1. The motherboard and BIOS support RAID configuration. 2. The motherboard has 2 or more available SATA protocol SSD/HDD slots (including MSATA, M.2...
0
marktang
by: marktang | last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However,...
0
by: Hystou | last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.