Re: hiding global variables

* yahalom <yahalome@xxxxxxxxx>
| > I don't understand anyway what the purpose of that key is if
| > anyone is allowed to use it, so I'd better EOmyD here...
|
| this is the whole point. I do not want anyone to use my decrypting
| key. I do the decrypt in a package and anyone that knows about the
| package can decrypt the data. so I want to have a password or key
| sent to the procedure so it will checked for correctness.

Just so I get it right:

- the user types in a password
- you check the password and if it is correct, you return the
decryption key
- the decryption key is a symmetric key which was also used for
encryption, so it should not get published?
- you are concerned about disclosure of that encryption key, not about
the disclosure of the encrypted data?

Is this the scenario?

If so, use public-key encryption instead? Encrypt the data with your
private key, and encrypt the public key with a password. That way, if
anyone snoops the password, they can get the public key and the data,
but not your private encryption key.

R'
.

Relevant Pages

  • RE: Cannot decrypt files encrypted using Crypto API on a different
    ... previous message which uses the recipien't public key.) ... KEK (key encryption key) to protect the session key. ... embedded into your client app and server code). ... but what is the point to encrypt the data if ANYBODY can decrypt it (since ...
    (microsoft.public.platformsdk.security)
  • Re: Encrypted files -- would this work to get them back?
    ... encryption key, a private decryption key and a symmetric FEK File Encryption ... for each machine that is used to protect all the master keys on the system. ... A combination of asymmetric [public key] encryption and symmetric [one ... decrypt the master key is used to decrypt the private key is used to decrypt ...
    (microsoft.public.windowsxp.security_admin)
  • RE: Cannot decrypt files encrypted using Crypto API on a different
    ... previous message which uses the recipien't public key.) ... KEK (key encryption key) to protect the session key. ... embedded into your client app and server code). ... but what is the point to encrypt the data if ANYBODY can decrypt it (since ...
    (microsoft.public.platformsdk.security)
  • RE: PGP scripting...
    ... that you keep the private key secret. ... Here is a quick over view of the public key encryption routines (the ... Since only he, through the use of his private key, can decrypt the ...
    (SecProg)
  • How do I Use DPAPI to Encrypt and Decrypt Data (C#/VB.NET)?
    ... Use DPAPI to Encrypt and Decrypt Data ... The code below demonstrates how to call Data Protection API (DPAPI) ... In addition to encryption and decryption, ... public static string Encrypt ...
    (microsoft.public.dotnet.framework.aspnet.security)