🚀 go-pugleaf

shah@wg.com wrote:
>I am developing a windows 3.1 app.  This app needs to authenticate a user 
>login by the user name and his/her password.  I need to store this password in 
>some sort of a format in some sort of a file (maybe an ini file).  But first I 
>need to encrypt this password and later on de-crypt to check against the 
>entered password (or maybe there is a better way - I just don't know yet).  
>Could any of you please point me in a better way or point me to some known 
>used technique for this procedure ?

Here is some code to do it! The basic principle is simply to multiply
the ASCII code for each letter by the weighting in the string. This can
not return you the old string (ie. its one-way), so it is more secure.
However more than 1 password may have the same number after encrypting.
Hope this helps


#include <stdio.h>

void main()
{
        int     total = 0;
        char    password[20];
        int     i;

        gets(password);
        for (i = 0; i < strlen(password); total += password[i] * i++);
        printf("Encrypted value is %d\n", total);
}


Al

shah@wg.com writes:


>Hi there !

>I am developing a windows 3.1 app.  This app needs to authenticate a user 
>login by the user name and his/her password.  I need to store this password in 
>some sort of a format in some sort of a file (maybe an ini file).  But first I 
>need to encrypt this password and later on de-crypt to check against the 
>entered password (or maybe there is a better way - I just don't know yet).  

The best way to do this as to use a one-way encryption and only store
the encrypted password. When the user enters the new password, encrypt
that in the same way and compare with the original encrypted password.
In this way, noone can get the original password even if they have
access to the encrypted version.

A good place to start the encryption is to use a CRC 32, combined with
some other methods. The source code for this should be available in
several places. Check the FAQ's of comp.lang.c++ and sci.crypt.

>Could any of you please point me in a better way or point me to some known 
>used technique for this procedure ?

>I would much appreciate your help.

>Thanks
>Ajay Shah
>(ashah@eceyv.ncsu.edu)
>(shah@wg.com)


-- 
   Niels Ull Jacobsen, Dep. of CS, U of Copenhagen (null@diku.dk)
   Roenne Alle 3 st.th, 2860 Soeborg, Denmark, tel. +45 39 66 39 86

In article <NEWTNews.807898837.21140.shah@shah.wg.com>, shah@wg.com wrote:
>Hi there !
Hail to you!

>I am developing a windows 3.1 app.  This app needs to authenticate a user 
>login by the user name and his/her password.  I need to store this password 
>in some sort of a format in some sort of a file (maybe an ini file).  But 
>first I need to encrypt this password and later on de-crypt to check against 
>the entered password (or maybe there is a better way - I just don't know 
>yet).  Could any of you please point me in a better way or point me to some 
>known used technique for this procedure ?
>I would much appreciate your help.
>Thanks

Here you are:

 FUNCTION ConvertTxt (S : String) : String;
 Var X : Byte;
 Begin
   ConvertTxt[0] := S[0];
   For X := 1 to Length(S) do
     ConvertTxt[X] := Chr(Ord(S[X]) XOR (Random(128) or 128));
 End;
 
 To encrypt a string, you just call ConvertTxt(string). Call
 the function again, with the same parameters to decrypt.
 Anyone have anything better, or have any suggestions?

 Here is basically the same function again.  However note the
 RandSeed assignment - RandSeed is set to the length of the
 string before a string is processed.  Since the length of
 the string never changes, you can randomly pick any string
 and be able to decrypt it.  RandSeed is used to make Random
 return a specific sequence of psuedo-random numbers, and
 this encryption method relies on the same sequence in order
 for it to decrypt.

  PROCEDURE EnDecrypt(VAR S: String);
  VAR
    X: Byte;
  BEGIN
    RandSeed := Length(S);
    FOR X := 1 TO Length(S) DO
      S[X] := Chr(Ord(S[X]) XOR (Random(128) OR 128));
  END;

Hope this helps.

Paz y pesetas.

.. "Ain't no time for regret when you body is in a bag" - BioHazard

In <NEWTNews.807898837.21140.shah@shah.wg.com>, shah@wg.com writes:
>
>Hi there !
>
>I am developing a windows 3.1 app.  This app needs to authenticate a user 
>login by the user name and his/her password.  I need to store this password in 
>some sort of a format in some sort of a file (maybe an ini file).  But first I 
>need to encrypt this password and later on de-crypt to check against the 
>entered password (or maybe there is a better way - I just don't know yet).  
>Could any of you please point me in a better way or point me to some known 
>used technique for this procedure ?
>
  As you're in the US, you could look at the RSA encryption algorithm in PGP
as an encryption method or try a fixed key rotating XOR on the password. The
latter is not very secure but is quite easy to implement. There are a great
many encryption algorithms around, try the University library for books
os standard algorithms.

--
Sam Nabialek
Kelsey Instruments Ltd
Email: nabialek@kelseyuk.demon.co.uk

Be careful using Random() functions!  The trouble can arise when you
change compilers (and possibly the Rand function implementation).
When you send your upgrade to your customers, their stuff will
no longer pass the password test.

I had this happen to me a few years ago.  ONe of the major hardware
houses upgraded their OS and compilers -- What a mess!

You're probably better off writing your own random number generator
instead of linking in the library one.

Lynn

In <NEWTNews.807898837.21140.shah@shah.wg.com>, shah@wg.com writes:
>
>Hi there !
>
>I am developing a windows 3.1 app.  This app needs to authenticate a user 
>login by the user name and his/her password.  I need to store this password in 
>some sort of a format in some sort of a file (maybe an ini file).  But first I 
>need to encrypt this password and later on de-crypt to check against the 
>entered password (or maybe there is a better way - I just don't know yet).  
>Could any of you please point me in a better way or point me to some known 
>used technique for this procedure ?

The best way I know of is to use a one-way function or a hash function.  This is essentially an algorithm
that takes some data and encrypts it in such a fashion that the original information cannot be recovered
in any way (hence the name one-way function).  The ciphered data is unique!! ie there is a one to one
mapping from input to output.  Thus when a user sets a password, the cipher text is computed and stored
(in a clear file).  When the user then enters his password, the password is passed through the same algorithm
and then compared with the stored cipher text.  If they are the same the password is accepted.  This means that
the ciphered password never has to be deciphered which means that it is difficult to break.  I believe this technique
is used extensively for storing and checking passwords in Unix.

Cheers
   Bruce Diesel 

In article <409t0n$45p@odin.diku.dk>, Niels Ull Jacobsen <null@diku.dk> wrote:
>shah@wg.com writes:
>In this way, noone can get the original password even if they have
>access to the encrypted version.

But they don't need the original password to crack it.  All they need
is any password that encrypts to the same result.  Can't they just
look at the result and determine what pattern is needed in a password
to generate that result?

In article <409ska$9pc@speedy.cci.de>, Alistair Priest <alistair@cci.de> writes:
|> shah@wg.com wrote:
|> >I am developing a windows 3.1 app.  This app needs to authenticate a user 
[snip]
|> Here is some code to do it! The basic principle is simply to multiply
|> the ASCII code for each letter by the weighting in the string. This can
|> not return you the old string (ie. its one-way), so it is more secure.
|> However more than 1 password may have the same number after encrypting.
|> Hope this helps
|> 
|> 
|> #include <stdio.h>
|> 
|> void main()
|> {
|>         int     total = 0;
|>         char    password[20];
|>         int     i;
|> 
|>         gets(password);
|>         for (i = 0; i < strlen(password); total += password[i] * i++);
|>         printf("Encrypted value is %d\n", total);
|> }
|> 

Hmm.. This doesn't seem to encrypt *ONE* character passwords very well.

password = "A", total = 'A'.

-rg

As others have written, the way to go is a one-way algorithm, where
you compare two passwords by comparing their encrypted forms.

A good public key one-way function for this is the knapsack algorithm.
It has the advantage over others that it's *very* easy to understand,
not difficult to verify the security of, and easy to implement in
laguages without good bit-shift operations (like Visual Basic).

The basic algorithm is to take a vector (an array) of seemingly random
numbers. You then chop your plaintext into a vector of bits. Calculate
the product of the two vectors (Start with 0, loop through all the
elements in the vectors and if the bit in the plaintext vector is set,
then add the corresponding element from the key vector)

Cryptographic security and decryptability with this method relies on
complex maths, but you can get basic one-way encryption by using 
any well-distributed set of random numbers.

Using a "salt" is also a good idea.  Look it up in your favourite Unix
(or Minix/Linux) reference book.

--
Andy Dingley                          dingbat@codesmth.demon.co.uk                                          

If all it takes is an infinite number of monkeys with typewriters, 
how come AOL haven't written any Shakespeare yet ?

>Hmm.. This doesn't seem to encrypt *ONE* character passwords very well.
>
>password = "A", total = 'A'.
>
>-rg
>


No, total = 64. The same total if as if your password were "# ".

And anyway, do you use *ONE* character passwords? Any system which
which requires a password should want a minimum of about 4 or 5 
characters with a mixture of letters and numbers etc.

Al

bdiesel@aztec.co.za@aztec.co.za writes:

>In <NEWTNews.807898837.21140.shah@shah.wg.com>, shah@wg.com writes:
>>
>>Hi there !
>>
>>I am developing a windows 3.1 app.  This app needs to authenticate a user 
>>login by the user name and his/her password.  I need to store this password in 
>>some sort of a format in some sort of a file (maybe an ini file).  But first I 
>>need to encrypt this password and later on de-crypt to check against the 
>>entered password (or maybe there is a better way - I just don't know yet).  
>>Could any of you please point me in a better way or point me to some known 
>>used technique for this procedure ?

> The best way I know of is to use a one-way function or a hash
> function.  This is essentially an algorithm that takes some data and
> encrypts it in such a fashion that the original information cannot
> be recovered in any way (hence the name one-way function).
Right.
> The ciphered data is unique!! ie there is a one to one mapping from
> input to output.

Wrong. This is not necessary and usually won't be true. It doesn't
really matter whether MySecretPassword and d2kj32#Ag$a1 both are coded
to 3df3df20.@An35.  The point is that you can't (in a reasonable
time) get any of them given only the encrypted string, 3df3df20.@An35. 

>  Thus when a user sets a password, the cipher text
> is computed and stored (in a clear file).  When the user then enters
> his password, the password is passed through the same algorithm and
> then compared with the stored cipher text.  If they are the same the
> password is accepted.  This means that the ciphered password never
> has to be deciphered which means that it is difficult to break.  I
> believe this technique is used extensively for storing and checking
> passwords in Unix.

Right.

If you have access to the encrypted strings, the scheme CAN be broken
simply by encoding EVERY possible password (up till say 8 characters)
and comparing the resulting values with the encrypted strings. The
only problem is that there are a LOT of 8 character strings, so it'll
take a bit of time.

Of course, you could start by trying every word in the dictionary, all
the names from the Atlas and all the characters in "Lord of the
Rings". This is feasable and have been done. 

Some systems even check this when the user is changing his password and disallows these words.

Therefore, dear user: 

1. Never use an existing word or name as a password. Use something
unintelligible, like mine: "preKrof"

2. Never reveal your password to anyone.


>Cheers
>   Bruce Diesel 

-- 
   Niels Ull Jacobsen, Dep. of CS, U of Copenhagen (null@diku.dk)
   Roenne Alle 3 st.th, 2860 Soeborg, Denmark, tel. +45 39 66 39 86

erc@cinenet.net (Eric Smith) writes:

>In article <409t0n$45p@odin.diku.dk>, Niels Ull Jacobsen <null@diku.dk> wrote:
>>shah@wg.com writes:
>>In this way, noone can get the original password even if they have
>>access to the encrypted version.

>But they don't need the original password to crack it.  All they need
>is any password that encrypts to the same result.  Can't they just
>look at the result and determine what pattern is needed in a password
>to generate that result?

The point of the encryption algorithm is to make this *hard*. A
(hypothetical) example:

You take the CRC32 of the first half and the last half of the password.
Now you use these values as seeds to two instances of your (custom)
random generator.  You generate two large numbers, mulitply them and
store the result.

This will (probably) make it rather hard to guess a password which
fits.

For a more scientific approach, check sci.crypt.
-- 
   Niels Ull Jacobsen, Dep. of CS, U of Copenhagen (null@diku.dk)
   Roenne Alle 3 st.th, 2860 Soeborg, Denmark, tel. +45 39 66 39 86

Alistair Priest <alistair@cci.de> wrote:

>And anyway, do you use *ONE* character passwords?

If he does, I can break into his system with a maximum of 256 brute 
force tries :)

-- 
Tom Childers
Information Resource Management
Lockheed Martin Tactical Aircraft Systems

null@diku.dk (Niels Ull Jacobsen) wrote:

>For a more scientific approach, check sci.crypt.

There is a good book concerning computerized cryptography that I got at 
the bookstore not long ago.  I don't recall the name of the book, but it 
has a drawing of a stelth aircraft on the front cover.  It contains many 
different encryption routines and descriptions of their advantages and 
disadvantages.  

-- 
Tom Childers
Information Resource Management
Lockheed Martin Tactical Aircraft Systems

[Snip]
>Therefore, dear user: 
>1. Never use an existing word or name as a password. Use something
>unintelligible, like mine: "preKrof"
>2. Never reveal your password to anyone.

 ROTFL :-) :-) :-)

David

----- Standards are great. Everyone should have one ! (Charles Moore) -----
David Brabant,             | E-mail: David.Brabant@csl.sni.be
Siemens Nixdorf (SNI),     | X-400:  C=BE;A=RTT;P=SCN;O=SNI;OU1=LGG1;OU2=S1
Centre Software de Liège,  |         S=BRABANT;G=DAVID
2, rue des Fories,         | URLs:   www.sni.de       www.csl.sni.be/~david
4020 Liège (BELGIUM)       | Phone:  +32 41 201 609     FAX: +32 41 201 642

Hi, does anyone have a routine to check the numerical input from an 
editable text box (lets call it edit_box) and then matching it to a 
list of 15 stored numbers for the closest match. I am using Borland 
C++ 4.2 and Win 3.1.

E.g.

Person types in number 516 -->--- Matching routine ------> Closest match : 520.

Thanks.

Tim.



-- 
* Timothy Lloyd and Anastasia Black
e-mail : tlloyd.ablack@zetnet.co.uk
WWW : http://webzone1.demon.co.uk/standard/1000.htm

-- We think and therefore we very possibly are. 
-- Redheads, unlike hotheads are symbols of controlled power.