encrypt, not encrypt, why encrypt and how encrypt?

Do you have a question? Post it now! No Registration Necessary.  Now with pictures!

Threaded View
Hi All

I know what I'm about to put down is probably more theorectical than an pure
web design prob, but I don't know where else to post!! :0)

Basically I've created a classic asp web app that connects to an sql 2008
express db via ssl and even though the whole sys runs on/through ssl I've
been told that I should encrypt certain parts of the db's content just in
case anybody gets onto my server and hacks into the db.

Now I started to use an old Base64 encryption with a key bit of code that
I've had for a bit, but somebody told me that base64 just converts the text
into a better transport method rather than actually encrypting it and its
easy to hack, but I've put a long key in and it doesn't seem to convert back
and forth properly without knowing the key - are they right??  Should I be
using something else?

Having started to encrypt certain parts, eg a person's name, dob, etc, it
suddenly dawned on me that although I'm encrypting and decrypting as I go if
I want to do search queries then it ain't gonna work.  For example if I want
to find all the people with 'gar' in their name then this isn't going to
work and if I want to find all the people who are born between Apr and May
then this isn't either.

My second query is, if I've got the dbs on a dedicated server running only
one site, loads of password access only stuff and on https do I really need
to encrypt db fields as well??  If so, how do I get round these query (and
sort order) issues??

Thanks

M




Re: encrypt, not encrypt, why encrypt and how encrypt?

On 6/21/2012 1:01 PM, Mojo wrote:
Quoted text here. Click to load it

That is probably good advice.

Quoted text here. Click to load it

Base 64 is not encryption.

Quoted text here. Click to load it

Extremely.


I have never heard of Base64 taking a key.

Quoted text here. Click to load it

Yes. AES, I believe, is the current standard for strong encryption.

Quoted text here. Click to load it

Why are you encrypting this data? It does not seem important enough to
encrypt.

Quoted text here. Click to load it

True. This is why I would be reluctant to encrypt everything. Passwords
and other sensitive information should be encrypted, but not all data is
sensitive.

Quoted text here. Click to load it

Yes.


OK, my question to the group: how do you hide the key? Once the key is
found, all encryption becomes moot.

Re: encrypt, not encrypt, why encrypt and how encrypt?

Hi Scott

Many thanks for your prompt and great responses.

Your last one is so pertinant.  If I do a fancy encrypt/decrypt routine in
my ASP so that the stored data is gobbledegook what does it matter if they
get on the server, find the encryption key in the relevant asp page and then
start decrypting whatever they like.  You're basically providing them with
the car key and the car so they can drive off with it.  Whats the point of
encrypting the data??

On 6/21/2012 1:01 PM, Mojo wrote:
Quoted text here. Click to load it

That is probably good advice.

Quoted text here. Click to load it

Base 64 is not encryption.

Quoted text here. Click to load it

Extremely.


I have never heard of Base64 taking a key.

Quoted text here. Click to load it

Yes. AES, I believe, is the current standard for strong encryption.

Quoted text here. Click to load it

Why are you encrypting this data? It does not seem important enough to
encrypt.

Quoted text here. Click to load it

True. This is why I would be reluctant to encrypt everything. Passwords
and other sensitive information should be encrypted, but not all data is
sensitive.

Quoted text here. Click to load it

Yes.


OK, my question to the group: how do you hide the key? Once the key is
found, all encryption becomes moot.



Re: encrypt, not encrypt, why encrypt and how encrypt?

On 6/21/2012 4:25 PM, Mojo wrote:
Quoted text here. Click to load it

If someone gets physical access to your server, there isn't much you can
do other than have a file system which encrypts the data on the disk
itself and has a secure password.  The secret here is to ensure your
server is in a secure location.  Of course, putting your database on one
server and your scripts on another will help, but is still not a perfect
solution.

Encrypting your data will protect it if someone gets access to your
database.  They would also have to have access to the scripts which
encrypt/decrypt the data.  This is much harder - especially if the
scripts and database are on separate servers.

Whether you need to encrypt data or not is pretty dependent on the data
you have.  For instance, in the U.S., medical records should pretty much
always be encrypted, and the server(s) in a very secure location.
Failure to secure the data could wind you up in prison.

But things like credit card numbers should always be encrypted also (or
don't even keep them once the purchase has been ok'd).  There are any
number of times even large companies have been hacked and credit card
numbers stolen.

As Scott mentioned, passwords should also be encrypted - or, more
preferably, hashed with a one-way algorithm.  That way even if someone
gets the database they can't decrypt the password.

Other data - pretty much anything which might be personally sensitive.
For instance, birth dates might be, depending on the person.  Email
addresses, definitely (you don't want someone getting your email address
list and spamming your customers).  And anything else you wouldn't want
to get out.

Also, when I encrypt sensitive data, I use a different seed for each
user.  It might be part of the user id, part of the date they first
registered, or whatever.  The point being even if someone gets access to
the encrypted data, a dictionary attack will be that much harder.

On the internet, security is EVERYTHING.  I daily have people trying to
hack my servers - I can see all kinds of things in the logs.  And a
shared host can potentially be even less secure, because you don't know
how secure the other sites on your host are (a good hosting company can
isolate users from one another, even on the same machine - but many
don't know how to do it properly).  From the questions you're asking, I
suspect you aren't aware of many security aspects.  Just encrypting your
data is only the start.  I highly suggest you read up on security
(sorry, I don't have any good references right off hand).

P.S. Please don't top post.  Thanks.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================



Re: encrypt, not encrypt, why encrypt and how encrypt?

On 6/21/2012 2:25 PM, Mojo wrote:

Quoted text here. Click to load it

The encryption key should never be hard coded into the script. I have
mine in a directory above the html document root with the permissions
set so that it is not accessible from the outside world. My gut feeling
is that this is not secure enough. I'd love to know of a better place to
put it.

Site Timeline