[Flex3/AIR] Storing encrypted data

What symbols can I use when I store encrypted data in a
encrypted local store. I'm trying to store a filepath to it, but
when I try to load it again, I get error # 2030: End of file was
encountered.
Anyone who knows what the problem is?
RdJ-1

Hi,
Are you trying this ,
DECLARE @Tmp TABLE(Data XML)
INSERT @Tmp SELECT '<Data>Password</Data>'
SELECT * FROM @Tmp
--Converting XML into VARCHAR and then inserting Encrypted value into VARBINARY column
DECLARE @Tmp1 TABLE(Data VARBINARY(500))
INSERT @Tmp1 SELECT (EncryptByPassPhrase('XX',CONVERT(VARCHAR(500),Data))) FROM @Tmp
SELECT Data Encrypted FROM @Tmp1
--Decrypting by passing passphrase
SELECT CONVERT(XML, DECRYPTBYPASSPHRASE ('XX',Data)) Decrypted FROM @Tmp1
sathya - www.allaboutmssql.com ** Mark as answered if my post solved your problem and Vote as helpful if my post was useful **.

Similar Messages

How to handle HTTP-POST encrypted data for ECC Using proxy or RFC

I have a scenario HTTP-POST ->PI->ECC.sender is HTTP Post send encrypted data i need to handle the data and stored in to SAP ECC with out decrypt using PI .what should i take for receiver can i use inbound proxy or RFC and how can handle the encrypted data for decrypt.
Regards
Ravi

1. my sender is HTTP POST . what should i configure in sender communication channel in SAP PI .like SOAP or HTTP .What are the parameters i need to pass .
>>>
If you are on PI 7.3 and above, configure the HTTP AAE adapter - Configuring the Java HTTP Adapter on the Sender Channel - Advanced Adapter Engine - SAP Library
2.while using inbound proxy for encrypted data i need store the data in to table , the same proxy can i call another outbound service for decrypt same data.
>>>>
Yes you can always a proxy within a proxy.

How to insert encrypted data by using blowfish into mysql database

Hi
I have encrypted data using blowfish algorithm . And i tried to insert that encrypted data into mysql. it was stored but i dont know that it stores in the same encrypted formate
When i am trying to get the encrypted data from the mysql database and decrypting that data i am getting errors.
Exception are like
input length should be multiple of 8 bits
or Given block are not properly padded
and when i am displaying the data using system.out.println ();
the string is not similar to the string which is in database.
what is the problem how can i solve my problem
thank you

It sounds like your column is a VARCHAR so you need to Base64 or Hex encode the cipertext bytes before putting them in the database.

How to make encrypted data more secure?

Hi All,
We are using Oracle 9i database. We have a task to encrypt some of data before storing into database. We have developed a function to encrypt the data using Dbms_Obfuscation toolkit. But, the user who has access to that function source code can easily decrypt the data. Now we need to have the solution so that we can securely save/store Encryption Key, which can be accessed by Application User only.
One alternative we are thinking is creating a table in SYS user and storing the value there. We can grant SELECT privileges to Application User Only.
We are looking for other alternatives if we have any. Do you have any idea?
Thanks in Advance.
Thanks and Best Regards,
Dharmesh Patel
Database Server:
Oracle9i Enterprise Edition Release 9.2.0.1.0 - 64bit Production
With the Partitioning, OLAP and Oracle Data Mining options
JServer Release 9.2.0.1.0 - Production
******************************************************/

I had a look at this conundrum a while back, when we wanted to store credit card details in a database. Basically, there are two choices:
(1) Don't store the key in the database and make the users type it in whenever they want to see encrypted data; or
(2) Store the key in the database and accept the risk that it might be abused by privileged users (i.e. DBAs).
As many users have difficulty remembering their password when it's MOM123 I think it's unlikely they will be able to cope with a properly secure PKI string.
You can mitigate the risks inherent in option 2 by having very strong auditing of the function's execution, but I'm sure knowledgeable, black-hatted DBAs will be able to find workarounds.
But, if you can't trust your DBAs you're probably stuffed anyway.
Cheers, APC

Encrypting data for testing - but keeping it legible and the right length

Hello,
I currently work with a client where one of our final stages of testing is done against test databases (9.2), maintained by the client, but holding real data, taken as a snapshot. This gives us volumes of data similar to what will be encountered in production.
The client now has a (valid) concern that our people testing the app therefore get to see 'real', if slightly out-of-date, data, particularly names and addresses, and have asked us if there's some way of hiding this from the testers, who have access to the test db both through a front-end mainly built on Oracle Forms, but also e.g. querying directly with SQL Plus.
I can't just give all the parties stored in the system the same name or address, so what I think I'd like to do is to replace the sensitive data with encrypted versions, possibly using the DBMS_OBFUSCATION_TOOLKIT. A problem with that, though, is that the encrypted data could contain any characters and may cause problems displaying in the front-end, certainly where testers have to e.g. type in a name to search on.
I could use rawtohex to convert the data into an easily read / typed format, but then the results could be too long for the existing columns and the fields in the front-ends.
Has anyone encountered a similar problem and come up with a solution?
Thanks in advance,
James

There are a variety of tools out there sold by companies to automate this sort of thing.
One relatively common, and relatively simple, approach would be to run a process that mixes and matches data from different records. That is, you take the first name from record 1, the last name from record 2, address from record 3... Of course, you'd have to figure out how sophisticated a jumbling algorithm you need depending on how sensitive the data and how performant an algorithm you need depending on data volumes.
Relatively efficient, but relatively simple to reverse, would be to use something like this to populate the tables
insert into emp( ename, sal, comm )
select ename,
lag(sal) over( order by empno ),
lag(comm,2) over (order by empno )
from emp@prod_db_linkJustin

EFS, password change denies access to encrypted data

Hi,
Has anyone had the issue with admin changing users password in Console One
resulting in users not being able to access their encrypted data.
Laptop users are using EFS to encrypt their data.
These users have WinXPPro SP2 and we are running ZfD 6.5SP2.
I have found IR 1 for ZfD 6.5 SP2 which includes TID3003874 "Personal IE
certificates and EFS stop working after password change" however this does
not fix the issue.
Could someone explain in more detail what this fix does as I may have
misunderstood what this fix is.
Regards,
Eric.

I know this is an old thread, but I thought it would be best to those who
found it realized that the best method for addressing this issue may be
found here:
http://www.novell.com/support/viewCo...rnalId=3724689
However the MS article could still be useful for some.
Craig Wilson - MCNE, MCSE, CCNA
Novell Support Forums Volunteer Sysop
Novell does not officially monitor these forums.
Suggestions/Opinions/Statements made by me are solely my own.
These thoughts may not be shared by either Novell or any rational human.
"ghoskins" <[email protected]> wrote in message
news:[email protected]..
>
> I'm having the same problem. I ran acrosss this Microsoft KB and it
> seems to fix the issue. I'm not certain this is the best security
> practices, but it does work.
>
> 'User cannot gain access to certificate functionality after password
> change or when using a roaming profile'
> (http://support.microsoft.com/default...b;en-us;331333)
>
>
> --
> ghoskins
> ------------------------------------------------------------------------
> ghoskins's Profile: http://forums.novell.com/member.php?userid=12306
> View this thread: http://forums.novell.com/showthread.php?t=215857
>

What happens to encrypted data when the server is destroyed?

Backups to tape are encrypted with a certificate.
But what happens if the backup server is destroyed? Do I lose all the backup data on those tapes?
Can I backup the certificate or is it specific to that specific DPM server?
In the case of a catastrophic datacenter failure, where everything is lost except the tapes and the certificate, what is the process for recovering the encrypted data?

You can absolutely backup the certificates used for DPM encryption and you should store those somewhere safe (for example, burn to CD and put in a fireproof safe offsite somewhere secure in an encrypted file).
This section of TechNet describes the process: http://technet.microsoft.com/en-us/library/jj628058.aspx
If you had to recreate a DPM server to read the tapes then you'd need to the certificates in the correct certificate store on the DPM server, in addition you'd need to ensure you had the certificates for the certificate chain, if there is one, in the correct
locations in the cert store.
Once a cert expires, do not delete it from the DPM until all the tapes that have used that cert are no longer in use or have been overwritten.
The data would need to be imported through the recovery section in DPM but you'd be able to read and recover the data if the certs were present. No cert = no recovery.

Encrypting Data on part of a file system.

A few months ago, using hints I found on the internet, I was able to use diskutil command line utililty to create an encrypted partition of the same sort as when turning FileVault on in Security Preferences. File Vault doe not appear to offer a way to choose some pargt of the disk storage such as an entire drive of a folder on a drive. I was able to do it and it worked. When I mount the disk partition to the system (usualy by plugging it in and turning it on), I'm asked for the security pass phrase or key to decrypt it. Once mounted with the key supplied, I can access it as any other mounted disk with the type of access restrictions that might be present on any disk.Since I want the data to be truly privatem U decline to put the key into the a known place such as the keychain. I don't want just anyone who has a log on to this iMac to b e able to read this data. I want them to need to enter a private key to mount the data.
My only problem with this is the hoops I needed to go through to do this. It is complicated and invovlves setting up special partitions for the purpose.
Searching Finder help for encrypting data it offered a solution for data on a removable drive. The stepsare very simple and easy to do:
   a) Mount the files to be encrypted if they are not online. They also need to be in a folder or even an entire partition.
    b) Open Disk Utility (GUI version)
    c)Choose File > New > Disk Image From Folder (or New-> Disk Image ffrom a Device).
    d) Select the folder or disk you want to encrypt.
    e) A save dialog will pop up. Select the name of the archive you wish to create and select a location. I choose a removable disk partition which has enouh space. Select Compressed if you wish. Then Select Encryption and choose the key size for encryption from the drop dwon. When you click Save, Disk Utility begins creating a disk image that is (possibly) compressed and probably encrypted. Once done, the files in the folder or partiion are hiddent behind the encryption. To get to them, you much open the DMG file and supply the password to unlock the encryption. You can save the key in the keychain if you are not worreid about who can get in. If you wish to restrict access to fewer people, keep the key secret and provide a recovery mechanism that is suitable for you need.
   f) One the archive is created, the disk partition containing it may b4 mounted on the system (if it is not there already) and by opening the dmg file you will be asked for the key. The system will validate that the key works and the encryption and comprewssion are working. The archive will be mounted as a virual disk. It can be accessed by any useer of that computer unless the file permissions get in the way. Mounting it only when the computer is being used by authorized people allow you to mount and dismount the archive for use during a limited time.
I have a couple of questions here. Is there an easier way to do this? Is this encryption as strong as that used in FileVault?

No. I don't know why it would not be, except it is easier for a person to leave the disk mounted where anyone can then see it. With FileVault forcing a password on wake from sleep, it will likely be encrypted if anyone found it.
I'm not sure why you went to the trouble you did before, except the instructions might have been to create an encrypted partition as opposed to creating the disk image. Disk images have been around for at least a decade.
If you plan on backing up the image with Time Machine, use a sparse bundle disk image as it will write the data to small files, called stripes. Only the stripes that change get backed up instead of the entire image.

** How to encrypt data when saving it in DB directly?

Hi All,
I want a method to encrypt data in the database when saving it directly
that is when any one enabled to see the data he will see it encrypted!

Hi..
What is the oracle database version???
As you want the users to see the encypted data, the best option is use DBMS_CRYPTO to encrypt the data.
[http://download.oracle.com/docs/cd/B19306_01/appdev.102/b14258/d_crypto.htm]
[http://www.oracle-base.com/articles/10g/DatabaseSecurityEnhancements10g.php]
HTH
Anand
Edited by: Anand... on Oct 19, 2009 2:11 PM

Storing Unicode data in SQL Server 2000

hello,
I'm currently developing a website which must store Cyrillic characters in a SQL Server 2000 database. I know the database can store the data correctly because when I use the MS Front end to connect to the database I am able to copy/paste the text into the database columns correctly.
Retrieving the data from the database also works correctly and is displayed with the correct characters.
The problems I am having is that the text seems to get garbled during the SQL insert by the database driver. If I print out the SQL just before it is inserted the characters are still correct but once they get into the database they are wrong. I'm using the JDBC drive to connect to the database.
Any help would be appreciated,
Alan

I change the way I was storing the data from using unicode to getting the char values of each letter (ie \u1041 for Б) and storing them in the database. Then I parse the numbers when I bring them back out and combine them into the original String

In which table are stored the data of a set created by GS01?

Hi All,
could anyone tell me in which table are stored the data of a set created by GS01?
Thanks

Hi,
It's stored in SETHEADER, SETNODE and SETLEAF tables.
Regards,
Eli

Insert an encrypt data in a Table

Hi all,
i have encrypted a data with HmacMD5, all its fine. but when i've tried to insert encrypt data in my table, hash code may return symbols like �?��Z��x��. then when i do a select data has been corrupted. how can i encrypted in stardand symbols( like mysql passwords). here is my code:
            KeyGenerator kg = KeyGenerator.getInstance("HmacMD5");
            SecretKey sk = kg.generateKey();
            // Get instance of Mac object implementing HMAC-MD5, and
            // initialize it with the above secret key
            Mac mac = Mac.getInstance("HmacMD5");
            mac.init(sk);
            byte[] result = mac.doFinal(dirMAC.getBytes());
            String macenc=new String(result);
            String x = "jdbc:mysql://localhost/"+
                    "mydatabase?user="+user+"&password="+
                    pass;
            Class.forName("com.mysql.jdbc.Driver").newInstance();
            conn = DriverManager.getConnection(x);
            conn.createStatement().executeUpdate("insert into user " +
                    "(User,Password) values('system','"+myPass+"')");
            java.sql.ResultSet rs=conn.createStatement().executeQuery("select password "+
                     "from " +"user where user ='system' ");
            rs.next();
            if((rs.getString(1).equals(macenc))) {
                System.out.println(rs.getString(1)+" YES "+macenc);
            } else {
                System.out.println(rs.getString(1)+" NO "+macenc);
            }Output NO. and sometimes when hash has (') character Query not found.
thanks.

Thie is most probably the offending line
String macenc=new String(result);
It is never a good idea to try to convert arbitrary bytes into a String using this approach. Not all byte sequences have valid char representation. If you must have a String representation use Base64 or Hex encoding of your Hmac. Google for Jakarta Commons Codec to get a library to assist you with this.

PDF form storing old data

Hello, I am new to the forum and was hoping someone here would be able to help me with an issue I have run into or help me find someone who could.
I was recently working on a security assessment of a website and I found a PDF document for an employement application that appears to store old data within the code of the document. To explain further:
- I found the PDF form document on the website. When downloaded and opened with Reader it appears blank. The document is avaiable to download and then you are directed to email it to HR, so there is no online submission on the website.
- When opened in a text editor it displays mostly encoded text and numbers but there is portion of the document with lines that correspond to the fields in the document and contain information from previous instances of the document that has been filled out.
Has anyone encountered this before? If yes are there any remediations for a PDF form storing unwanted data within the code of the document?
Thanks in advance and sorry if I have posted this in the wrong location.

Filling in online forms should never allow the form to be saved back to the website. Usually such a form (or any online document) would go to the user's browser's temp folder, and be saved in there. I don't know how it was possible that user data got back onto the web server form (unless it was originally uploaded like that).
What I would do if I encountered such a situation
upload the clean, empty form
make sure the file is read-only
test it by filling in the form online
see if the original form has been altered in any way

Encrypting data in CSV files

I am creating a script that reads username and passwords from a CSV file. The passwords will change (and possibly the usernames as well) so instead of re-recording the script to use the new username/password, I wanted an external file to update.
This works good but the passwords are in CLEAR TEXT in the CSV file.
Is there a way to encrypt the password (or username and password) in the CSV file?
If so, is there an external application that can encrypt this without the need for the ATS Desktop application?

KZack
Right now you can not encrypt data in a CSV file, however this is a feature well talked about and i'm sure it will be available soon.
Regards
Alex

Export and Import encrypted data

Hi,
I have a database table with encryped data (encrypted using DBMS_OBFUSCATION_TOOLKIT.DES3Encrypt). I am having an issue when I export this table and import it into a new schema. The encrypted data seems to have changed after import. I am unable to decrypt it from the new schema.
Below is the character set details from export/import.
"Export done in WE8MSWIN1252 character set and AL16UTF16 NCHAR character set. Server uses WE8ISO8859P1 character set (possible charset conversion)."
"Import done in WE8MSWIN1252 character set and AL16UTF16 NCHAR character set."
Has anybody had this issue before? Does it have anything to do with the character set? If so, how do I fix it?
Thank you!

Hello,
since this question is about using the export utility, you might better ask this in {forum:id=61} or {forum:id=732}.
Regards
Marcus

[Flex3/AIR] Storing encrypted data

Similar Messages

Maybe you are looking for