Encrypt Password Problem

I am encrypting a password in my application. The problem I
am having is that one of my encrypted passwords starts with a
single quote. This is blowing up my SQL queries. Is there a way to
force CF to only use alpha or numeric characters?

I had a similar problem. I found that if I used
<cfqueryparam> on the password parameter, when checking it
against the encrypted value in the database, the error went away.
Below is a sample of the logon verification query that I use in one
of my applications where I use encrypted passwords.
<cfquery name="Q1" DATASOURCE="#dbname#">
SELECT admin_id, expire_date, access_level, enabled
FROM admin
WHERE LOWER(logon_name) = LOWER('#form.v_logon_name#')
AND password = <cfqueryparam value =
"#encrypt(form.v_password, cookie.pw_seed)#" CFSQLType =
"CF_SQL_VARCHAR">
</cfquery>
Phil

Similar Messages

ITunes will not let me backup and sync to new phone encrypted password??

iTunes will not let me backup and sync to new phone encrypted password?? I've never set a password for my old iPhone 3gs but tried my old Apple ID sign-in passwords to no avail. I've simply sat here so frustrated....my husband sync'd his new iPhone 4 no problem, somehow the checkbox shows Encrypted password and I'm at a loss on how to change this/find the password and transfer my old backup onto my new phone so I can use it. Can anyone help? Tnx

John,
buy an iTunes Music Card and redeem it to your account - the "none" option should be available then.

Decrypt the encrypted password

Hi there,
I have been scratching my head for some time to fix one issue. We are planning to change the plateform/technology and we need to bring over existing login to new system. In order to have the same password I need to decrypt the password before I send it to new system. When we stored the password, it encrypts them and stores it in database. I am using following code to decrypt it. it's not worlking . This is error I am getting.
Given final block not properly padded
Here is some more information:
Key is :javax.crypto.spec.SecretKeySpec@18f3a
Format is :RAW
getAlgorithm() is :DES
String encrypted = abcdefgh
Provider is: com.sun.crypto.provider.SunJCE()
This is my code to decrypt which throws error " Given final block not properly padded" :
public String decrypt(String encrypted){
          Cipher ci = null;
          byte [] result = null;
          try {
               ci = Cipher.getInstance("DES");
               ci.init(Cipher.DECRYPT_MODE, key);
               System.out.println("CryptoUtil()" +"before hexToByteArray. Byte Data: "+encrypted);
               byte [] encryptedData = hexToByteArray(encrypted, false);
               //Log.out("CryptoUtil()" +"after hexToByteArray. lenth: "+ encryptedData.length);
               result = ci.doFinal(encryptedData);
          catch (Exception e) {
               System.out.println("CryptoUtil()" +"ERROR: "+ e.getMessage());
               return encrypted;
          String strResult = new String(result);
          return strResult;
Please help.
Thank you.

These are the two values I am getting for encrypted password:
97654de7857cd9aab331995cba044fc6
a125a6b2a71e23adc002ac7fbe1a1042
Is this a hex code?
I think the key is: abcdefgh
This is my code to encrypt and decrypt:
      * empty constructor
      * @param keydata
     public CryptoUtil(String keydata){
          if (keydata.trim().equals("")){
               logDebug("CryptoUtil()" +" Constructor didn't get a valid key!");
               usage();
               System.exit(0);
          }else{
               keyBytes = keydata.getBytes();
               key = new SecretKeySpec(keyBytes, 0, keyBytes.length, "DES");
          try {
               Provider sp = new com.sun.crypto.provider.SunJCE();
               //logDebug("CryptoUtil() " + sp.getInfo());
                Security.addProvider(sp);
              }catch (Exception ex) {
                     logDebug("CryptoUtil() " +"Problem loading crypto provider \n error:"+ex.getMessage());
               usage();
                System.exit(0);
      * Encrypt
      * @param s
     public String encrypt(String s){
          Cipher ci = null;
              byte [] result = null;
              try {
               ci = Cipher.getInstance("DES");
               ci.init(Cipher.ENCRYPT_MODE, key);
               result = ci.doFinal(s.getBytes());
              }catch (Exception e) {
                    logDebug("CryptoUtil()" +"ERROR: "+ e.getMessage());
          String strResult = byteArrayToHex(result);
              return strResult;
      * decrypt a card number
      * @param encrypted
     public String decrypt(String encrypted){
          Cipher ci = null;
              byte [] result = null;
              try {
               ci = Cipher.getInstance("DES");
               ci.init(Cipher.DECRYPT_MODE, key);
               //Log.out("CryptoUtil()" +"before hexToByteArray. Byte Data: "+encrypted);
               byte [] encryptedData = hexToByteArray(encrypted, false);
               //Log.out("CryptoUtil()" +"after hexToByteArray. lenth: "+ encryptedData.length);
               result = ci.doFinal(encryptedData);
              catch (Exception e) {
               logError("CryptoUtil()" +"ERROR: "+ e.getMessage());
               return encrypted;
          String strResult = new String(result);
          return strResult;
     static final String hexDigitChars = "0123456789abcdef";
      * @param a
     public static final String byteArrayToHex(byte [] a) {
          int hn, ln, cx;
          StringBuffer buf = new StringBuffer(a.length * 2);
          for(cx = 0; cx < a.length; cx++) {
                hn = ((int)(a[cx]) & 0x00ff) / 16;
                ln = ((int)(a[cx]) & 0x000f);
                buf.append(hexDigitChars.charAt(hn));
                buf.append(hexDigitChars.charAt(ln));
                buf.append(' ');
         return buf.toString();
      * @param str
      * @param rev
     public static final byte [] hexToByteArray(String str, boolean rev) {
          StringBuffer acc = new StringBuffer(str.length() + 1);
          int cx, rp, ff, val;
          char [] s = new char[str.length()];
          str.toLowerCase().getChars(0, str.length(), s, 0);
          for(cx = str.length() - 1, ff = 0; cx >= 0; cx--) {
          if (hexDigitChars.indexOf(s[cx]) >= 0) {
               acc.append(s[cx]);
               ff++;
           }else {
               if ((ff % 2) > 0) acc.append('0');
                    ff = 0;
          if ((ff % 2) > 0) acc.append('0');
          byte [] ret = new byte[acc.length() / 2];
          for(cx = 0, rp = ret.length - 1; cx < acc.length(); cx++, rp--) {
                val = hexDigitChars.indexOf(acc.charAt(cx));
                cx++;
                val += 16 * hexDigitChars.indexOf(acc.charAt(cx));
                ret[rp] = (byte)val;
          if (rev) {
                byte tmp;
                int fx, bx;
                for(fx = 0, bx = ret.length - 1; fx < (ret.length / 2); fx++, bx--) {
                    tmp = ret[bx];
                    ret[bx] = ret[fx];
                    ret[fx] = tmp;
          return ret;
Will that give you any more information to help me?

Storing Encrypted passwords in SQL database

Hey folks!
I'm trying to encrypt a password to be put into a SQL database and then be decrypted when I pull it out to log a user in. Currently I can encrypt and store the password fine, but it's the grabbing and decrypting that is giving me troubles.
Sometimes I do get the correct string back from the decrypted database string, but not very often. The main error I get is BadPaddingException, which I've read in the forum is something to do with key/string descrepancies. I sometimes get a IllegalBlockSizeException as well.
When I look at the ASCII bytes stored in the database they are different from what is shown when I print them out on the screen using IE5.5.
I'm wondering if anyone out there has run into similar problems and overcame, or could help me along in the right direction. Thnx!
PJ

What you need to do is a combination of what has been said here. Let's say you are working with a MS SQL Server, encrypting with 3DES. You have your key located somewhere on the system and use that (or something else that is specific to that record).
1.) In your app, encrypt the text
2.) Base64 Encode it so you can shove it in the database (I have also put this as RAW bytes in an Oracle DB)
3.) make sure, when you are testing, that you check the length of the Base64 Encrypted Text you put in the database. SQL Server might add on extra characters to fill the field. i.e. if you are storing it in a varchar(250) field and you only fill 50 chars with your encrypted password, SQL Server might pad it with the extra 200. This will mess with your padding and throw an exception during the decryption process. I think I got around this with a simple TRIM statement when retrieving.
4.) Retrieve the text with a SQL statement
5.) Base64 Decode the text to get a byte array
6.) Use the decryption algorithm with your original key on the byte array.
I think that's it. Very quick. Low overhead on the server. Optimally, you would want to clear this from memory...blah blah blah....I could go on ;-p
I have a small API I've written for this using 3DES that has been working great ever since JCE 1.0. All I have to do is keygen a new key whenever I want to use it again.
Hope this helps,
RG

I updated iTunes to 10.5 and now my encryption passwords for my iPhone and iPad don't work.

I updated iTunes to 10.5 and now my encryption passwords for my iPhone and iPad don't work. I know Apple says if you forget them then it's your problem. However, this was a direct result of my iTunes upgrade. I spent hours trying to fix this. HELP!

Definitely seems to be a cross-platform bug in iTunes 10.5 concerning all NAS disks. Shared libraries on network drives worked fine under 10.4.1, but now there is just an endless loading cycle with no error message or time-out. There is a bit more about it in this thread.
Martin

Login with encrypted password doesn't work

Hi, simple problem:
in login settings with encrypted password option on
The login doesn't work => Error:"AFTER.Trigger_Login_CheckLogin*"
(tested with a user that has an encrypted password)
without encrypted password
The login works
(tested with a user that has a clean password)
Where I wrong?
Thanks
Gabriele

Hi Gabriele,
how many varchars did you define for the column that´s holding the encrypted passwords ? It has to be at least 32 chars due to the MD5 encryption, if it´s lesser than that, the passwords will get truncated.
Cheers,
Günter Schenk
Adobe Community Expert, Dreamweaver

How to get password as string back from encrypted password byte array.

Hi All,
I am storing encrypted password and enc key in the database.(Code included encryptPassword method for encryption and validatePassword method for validating of password). Problem is that for some reason i need to show user's password to the user as a string as he/she entered. But i am not able to convert the encrypted password from D/B to original String.
Tell me if any body know how to get the string password back from the encrypted password byte array after seeing my existing encryption code.
//********* Code
private Vector encryptPassword(byte[] arrPwd)
try
// parameter arrPwd is the password as entered by the user and to be encrypted.
byte[] encPwd = null;
byte[] key = null;
/* Generate a key pair */
KeyPairGenerator keyGen = KeyPairGenerator.getInstance("DSA", "SUN");
SecureRandom random = SecureRandom.getInstance("SHA1PRNG", "SUN");
keyGen.initialize(1024, random);
KeyPair pair = keyGen.generateKeyPair();
PrivateKey priv = pair.getPrivate();
PublicKey pub = pair.getPublic();
/* Create a Signature object and initialize it with the private key */
Signature dsa = Signature.getInstance("SHA1withDSA", "SUN");
dsa.initSign(priv);
/* Update and sign the data */
dsa.update(arrPwd, 0, 12);
/* Now that all the data to be signed has been read in, generate a signature for it */
encPwd = dsa.sign();
/* Now realSig has the signed password*/
key = pub.getEncoded();
Vector vtrPwd = new Vector(2);
vtrPwd.add(encPwd);
vtrPwd.add(key);
return vtrPwd;
catch (Exception e)
private boolean validatePassword(byte[] arrPwd,byte[] encPwd,byte[] key) throws RemoteException
try
// arrPwd is the byte array of password entered by user.
// encPwd is the encrypted password retreived from D/B
// key is the array of key through which the password was encrypted and stored.
X509EncodedKeySpec KeySpec = new X509EncodedKeySpec(key);
KeyFactory keyFactory = KeyFactory.getInstance("DSA", "SUN");
PublicKey pubKey = keyFactory.generatePublic(KeySpec);
/* Encrypt the user-entered password using the key*/
Signature sig = Signature.getInstance("SHA1withDSA", "SUN");
sig.initVerify(pubKey);
/* Update and sign the password*/
sig.update(arrPwd, 0, 12);
return sig.verify(encPwd);
catch (Exception e)
Help upto any extent would be appreciated.
Thanx
Moti Singh

Hi All,
I am storing encrypted password and enc key in the
database.(Code included encryptPassword method for
encryption and validatePassword method for validating
of password). Problem is that for some reason i need
to show user's password to the user as a string as
he/she entered. But i am not able to convert the
encrypted password from D/B to original String.No, you are not encrypting the password in your code, you are merely signing it.
Tell me if any body know how to get the string
password back from the encrypted password byte array
after seeing my existing encryption code.It is impossible to retrieve the original text out of a signature.
You should read up on some encryption basics in order to understand the difference between signing and encrypting. Then you can find examples of how to encrypt something here: http://java.sun.com/j2se/1.4/docs/guide/security/jce/JCERefGuide.html.
Actually there is one class specifically for keeping keys secure, KeyStore http://java.sun.com/j2se/1.4/docs/api/java/security/KeyStore.html
- Daniel

WRT110 WIFI password problem

Hi Everyone,
I've got a very strange problem. First, I indicated WPA under Wireless Security section and typed in my passphrase. However when connecting to my wireless network name my passphrase never worked. Second, I completely disabled security and tried to simply connect without any passphrase, but I was still being asked for a passphrase nonetheless. I checked and double-checked and saved settings making sure security was disabled, but I was still being asked for a passphrase when choosing my wireless network!
I could probably restore my WRT110 to factory settings, however I don't want to loose other configurations like certain open ports and IP addresses I opened up for firewall.
Is there a way for me to resolve my WiFI password problem without restoring to factory default? I just need to figure out how to make the WiFi passpharse work. Here's what I have there:
Security Mode: WPA Personal
Encryption: TKIP
Passphrase: 0sunspot0
Key Renewal: 3600 seconds
However, when I pick my wireless network and try to connect to it by typing in 0sunspot0, I get authentication failure!
Am I doing something wrong?
Thanks,
Victor.
Solved!
Go to Solution.

I have misplaced all relevant info. for my router. I am trying to connect to a mini ipad. What do I need?
Is the router up and running and you would only want to add a device wirelessly? If so, you may access the setup page as sabretooth has said. To check the wireless settings, you may check this link, http://kb.linksys.com/Linksys/ukp.aspx?vw=1&docid=476326f36c294e579ba6691a8db5411e_3698.xml&pid=80&r...

Using Encrypter password in Hyperion Scripts

Hi Gurus,
I want to use encrypted password sin the Hyperion scripts.
We are using automated jobs which run cube refrshes, exports and various other operations but the problem is that these scripts use admin password.
So if we view the script the password is also visible, so need to use encrypted password.
i know we have openssh, crypt kinf of function for encrypting the passowrd, but i am not sure if the maxl will recognice the encrypted passowrd.
Also if i encrypt a password will that cause any problem in the shared services ?
Awaiting response
Thanks in Advance ,

If you are using Maxl then you can encrypt the scripts, for an example have a read of Encrypting passowrd in maxl
Cheers
John
http://john-goodwin.blogspot.com/

Disk Encryption password prompt

I have 2 macbook Pro Retina machines, Identical. One for work and a personal one.
Disk encryption is on for both machines.
My work machine just logs me in no problem.
My personal machine asks me for a disk encryption password every boot, then the login password. I can't find the setting to turn off the disk encryption password prompt.
What did i do differently?

So I solved it for myself.
seems I had encrypted the disk using DU from the pre-boot environment, therefore the encryption had occured without my user account holding the "keys" to the encryption. The end result is that a password is needed for both my account and the encryption seperately.
I turned off file vault as root from the command line and re-enabled it as my user. problem solved.

Weblogic 10.3 deployException: Could not encrypt password for connection

Well, I guess this is my first time posting in a forum.
My problem is that, when trying to run my servlet, using a jdbc:odbc connection
to an Access-database, I get the following error in the server log:
Running dependency analysis...
2009-03-27 16:59:40.106: Writing WAR file to C:\Program Files\JDeveloper\jdeveloper\system\system11.1.1.0.31.51.56\o.j2ee\drs\TableViewApplication\TableViewApplication-tableviewproj-webapp
2009-03-27 16:59:40.12: Wrote WAR file to C:\Program Files\JDeveloper\jdeveloper\system\system11.1.1.0.31.51.56\o.j2ee\drs\TableViewApplication\TableViewApplication-tableviewproj-webapp
ERROR: Could not encrypt password for Connection TBLViewConnect.
The connection I'm using works fine when testing it with the JDeveloper's SQL editor.
It's properties are:
Connection Name: TBLViewConnect
Connection Type: JDBC-ODBC Bridge
as well as username, password and a local datasource
I'm running JDeveloper 11.1.1 on Vista 32bit
Besides, it's my first time using a database-connection with a servlet
thanks for your help

guess I could have found that earlier ;)
I just had to uncheck the "save password" option in the connection menu and write it in the getConnection() method instead.

[Solved] System asks for encryption password multiple times

Hey guys,
I have following problem:
I am using dmcrypt for encryption of my hard drive but it seems like I have made a mistake when I installed it. But for the most time I ignored it.
When I start my system it ask for the encryption password normally. The strange thing is that it also asks for the Password when services start.
If I issue a command with systemctl start XXX I also get following message:
Please enter passphrase for disk Crucial_CTXXXXXSSD1 (lukslvm)
There is no problem if I just press Enter and go on actually but this still bugs me.
I wonder what I did wrong at that time.
Edit:
/etc/crypttab:
lukslvm UUID=xxxxxxxxxxx------xxxxxxxxxx none luks
lvm pvscan:
PV /dev/mapper/vgarch VG vgarch lvm2 [223,38 GiB / 0 free]
Total: 1 [223,38 GiB] / in use: 1 [223,38 GiB] / in no VG: 0 [0 ]
Last edited by Erhan (2014-12-17 12:45:53)

Fixed by removing the entry in /etc/crypttab
I don't even remember adding it there but it has been already some years.

Please help: Encrypt Password

Very small query which has confused me a lot.....
I have to encrypt passwords and save them in to database, I am not getting where to start as I do not know anything about java encryption packages or other things.
Please let me know where can I find the names of all the algorithms and it will be very nice if u can tell me that which one should I use.
thanx

Hi,
MD5 and SHA-x Algorithms do not encrypt, these are so called hash algorithms which means they create a (hopefully) unique, fixed length byte array from what you give as input. Usually that is a way to store Passwords because you never need to decrypt a password (in the case of hash algorithms you are not able to do so anyway). If a user signs in, you hash his password and compare that created hash with the stored hash value. If they are equal, you can be sure enough (1:2^100 or something as chance that two different passwords create the same hash code) that the user knew his password. I know a lot of eBusiness plattforms that store passwords as MD5 or SHA-1 hash values. I think they can be seen as secure enough for such purposes.
Another story if you need the password in cleartext (maybe to start a batch process) but you don't want to store it as clear text. Then you have to encrypt the password and decrypt it when needed. But then you run into the problem where to store the encryption key so that nobody can decrypt your password with that.
The public key encryption is only usefull if you need to create a so called secret between two parties via an unsecure communication media. Like the HTTPS protocol does. The browser and the web server are exchanging public information (public keys) and then they are able to communicate secure without the need to share sensitive information in advance. But that is definitely not needed for your scenario.
The HMAC is another completely different story. It just says that you "can" use the MAC address of your Network adapter for the hash algorithm, but you don't need to do so. Since it is hard to read the MAC address from java I would not suggest to go in that direction.
I that now light enough? ;-)
Stephan

How to encrypt password columns

I would like to create a table to store the username and password for all my application users. There are a problem with password encryption. When I create a table as follows,
create table usrmas
(username varchar2(10),
passwd varchar2(20))
All password from the passwd column will be disclosed when somebody query the table. It is not secure. Right?
When I tried to use the table dba_users, for example, there are a user scott with password tiger, I am fail to find a record when I type a sql as follows,
select *
from dba_users
where username = 'SCOTT'
and password = 'TIGER'
Please advice me how I can authenticate user. Thanks

If you have a 10g database, it should be installed by default.
Note, however, that Oracle stores hashed passwords, not encrypted passwords, in the dba_users table. That's more secure since there is no decrypt method for a hashed value. With a hashed value, you can only check whether the user has provided the right password, you can't find out what the right password is.
Justin
Distributed Database Consulting, Inc.
http://www.ddbcinc.com/askDDBC

Default Encrypted Password

Dear All,
i want to insert encrypted Password of 'password' string into table user_dtl column PASSWORD .
How can i insert Encripted password into table.
Thanks

Hi Vedant,
See the CUSTOM_HASH function that is installed with sample application in the APEX.
Here is the code for it:
create or replace function custom_hash (p_username in varchar2, p_password in varchar2)
return varchar2
is
l_password varchar2(4000);
l_salt varchar2(4000) := 'XFSPL28ZTWEWWM6FHWMK68AG5NQVLU';
begin
-- This function should be wrapped, as the hash algorithm is exposed here.
-- You can change the value of l_salt or the method of which to call the
-- DBMS_OBFUSCATOIN toolkit, but you much reset all of your passwords
-- if you choose to do this.
l_password := utl_raw.cast_to_raw(dbms_obfuscation_toolkit.md5
(input_string => p_password || substr(l_salt,10,13) || p_username ||
substr(l_salt, 4,10)));
return l_password;
end;
i want to insert encrypted Password of 'password' string into table user_dtl column PASSWORD.The above function will give the encrypted password which can be inserted into USER_DTL as follows:
INSERT INTO USER_DTL(USERNAME,PASSWORD) VALUES(:P1_USERNAME, CUSTOM_HASH(:P1_USERNAME,:P1_PASSWORD))Be sure that PASSWORD column in USER_DTL is of type VARCHAR2 and of adequate length as to accommodate the encrypted password.
Hope it helps!
Regards,
Kiran

Encrypt Password Problem

Similar Messages

Maybe you are looking for