Encryption

ebloom

Does Objo have a reversible encryption function? The methods in the Crypto module all seem to be for one way hashes.

Or maybe there's a better way? I need to store database connection info (server, port, username, password.) The info needs to be saved in a .ini file on the user's computer. In previous applications I've used RC4 encryption - I know this is no longer considered secure.

Bodevinaat

Use RC5. it is fast and secure. This is the Java implementation:

import java.util.ArrayList;
import java.util.List;

public class RC5 {
    // Constants for RC5-32/12/16
    private static final int W = 32; // Word size in bits
    private static final int R = 12; // Number of rounds
    private static final int B = 16; // Key size in bytes
    private static final int C
        = 4; // Number of words in key

    // Magic constants
    private static final int P = 0xB7E15163;
    private static final int Q = 0x9E3779B9;

    // Rotate left function
    private static int rotl(int x, int y)
    {
        return (x << y) | (x >>> (W - y));
    }

    // RC5 key expansion
    private static void rc5KeySetup(byte[] key, int[] S)
    {
        int[] L = new int[C];
        for (int i = B - 1; i >= 0; --i) {
            L[i / 4] = (L[i / 4] << 8) + (key[i] & 0xFF);
        }

        S[0] = P;
        for (int i = 1; i < 2 * (R + 1); ++i) {
            S[i] = S[i - 1] + Q;
        }

        int A = 0, B = 0;
        int i = 0, j = 0;
        for (int k = 0; k < 3 * Math.max(2 * (R + 1), C);
             ++k) {
            A = S[i] = rotl(S[i] + A + B, 3);
            B = L[j] = rotl(L[j] + A + B, (A + B) % W);
            i = (i + 1) % (2 * (R + 1));
            j = (j + 1) % C;
        }
    }

    // RC5 encryption
    private static void rc5Encrypt(int[] S, int[] data)
    {
        int A = data[0];
        int B = data[1];

        A = (A + S[0]);
        B = (B + S[1]);

        for (int i = 1; i <= R; ++i) {
            A = rotl(A ^ B, B) + S[2 * i];
            B = rotl(B ^ A, A) + S[2 * i + 1];
        }

        data[0] = A;
        data[1] = B;
    }

    public static void main(String[] args)
    {
        byte[] key = new byte[B];
        int[] S = new int[2 * (R + 1)];

        rc5KeySetup(key, S);

        int[] data = { 0x00000000, 0x00000000 };
        rc5Encrypt(S, data);

        // Convert the integer values to lowercase hex
        // strings and format the output
        System.out.printf("Cipher Text: %08x %08x%n",
                          data[0], data[1]);
    }
}

// This code is contributed by Shivam Gupta

Shouldn't be too hard to port it to Objo. On the other hand, RC4 is secure enough to use in daily applications. The insecureness of certain encryption algorithms is vastly exaggerated. I use it al the time. Just throw in a complex Salt.

This is a Xojo implementation:

Function RC4(strData As String, strKey As String) As String
  #If Not DebugBuild
  #pragma DisableBackgroundTasks
  #pragma DisableBoundsChecking
  #pragma DisableAutoWaitCursor
  #pragma StackOverflowchecking False
  #pragma NilObjectChecking False
  #EndIf
  Dim MM As MemoryBlock = strData
  Dim MM2 As New MemoryBlock(LenB(strData))
  Dim memAsciiArray(255) As Integer
  Dim memKeyArray(255) As Integer
  Dim memJump As Integer
  Dim memTemp As Integer
  Dim memY As Integer
  Dim intKeyLength As Integer
  Dim intIndex As Integer
  Dim intT As Integer
  Dim intX As Integer

  intKeyLength = Len(strKey)

  For intIndex = 0 To 255
    memKeyArray(intIndex) = Asc(Mid(strKey, ((intIndex) Mod (intKeyLength)) + 1, 1))
  Next

  For intIndex = 0 To 255
    memAsciiArray(intIndex) = intIndex
  Next

  For intIndex = 0 To 255
    memJump = (memJump + memAsciiArray(intIndex) + memKeyArray(intIndex)) Mod 256
    memTemp = memAsciiArray(intIndex)
    memAsciiArray(intIndex) = memAsciiArray(memJump)
    memAsciiArray(memJump) = memTemp
  Next

  intIndex = 0
  memJump = 0

  For intX = 1 To MM2.Size
    intIndex = (intIndex + 1) Mod 256
    memJump = (memJump + memAsciiArray(intIndex)) Mod 256
    intT = (memAsciiArray(intIndex) + memAsciiArray(memJump)) Mod 256
    memTemp = memAsciiArray(intIndex)
    memAsciiArray(intIndex) = memAsciiArray(memJump)
    memAsciiArray(memJump) = memTemp
    memY = memAsciiArray(intT)
    mm2.Byte(intX - 1) = bitwise.BitXor(Val("&h" + Hex(MM.Byte(intX - 1))), bitwise.BitXor(memTemp, memY))
  Next

  Return MM2
End Function

ebloom

Thanks. Looks like porting my existing Xojo stuff is the way to go.

Garry

Thanks for raising this. I’ve added authenticated reversible encryption to the Crypto module for the next release based on the .NET implementation.

https://feedback.objo.dev/feature/1369

For a separately stored 32-byte key:

Var key As MemoryBlock = Crypto.GenerateEncryptionKey()
Var encrypted As String = Crypto.Encrypt("database password", key)
Var decrypted As String = Crypto.Decrypt(encrypted, key)

The encrypted String is Base64, so it can be stored directly in an .ini file. There are also MemoryBlock overloads for binary data.

For a user-supplied master password:

Var encrypted As String = Crypto.EncryptWithPassword(secret, masterPassword)
Var decrypted As String = Crypto.DecryptWithPassword(encrypted, masterPassword)

This uses AES-256-GCM rather than RC4 or RC5. Nonces and salts are generated automatically, and modified data, incorrect keys, or incorrect passwords are rejected.

The encryption key or master password must be stored separately from the encrypted value. Embedding it in the application or placing it alongside the encrypted data would provide obfuscation rather than meaningful protection.