Encrypt / Decrypt help

28 Message(s) by 4 Author(s) originally posted in advanced cfml techniques

From: WolfShade

Date: Tuesday, October 23, 2007

Hello, all.

In the past, I always used HASH to encrypt the password

<security> An arbitrary string of characters chosen by a user
	or {system administrator} and used to authenticate the user
	when he attempts to log on, in order to prevent unauthorised
	access to his account.

	A favourite activity among unimaginative {computer nerds} and
	{crackers} is writing programs which attempt to discover
	passwords by using lists of commonly chosen passwords such as
	people's names (spelled forward or backward).  It is
	recommended that to defeat such methods passwords use a
	mixture of upper and lower case letters or digits and avoid
	proper names and real words.  If you have trouble remembering
	random strings of characters, make up an acronym like
	"ihGr8trmP" ("I have great trouble remembering my password").

	(1994-10-27)

for users; all I
needed to do was to check the HASHed value from login and compare to what is in
the db - simple.

Now I have a client

<programming> A computer system or process that requests a
	service of another computer system or process (a "{server}")
	using some kind of {protocol} and accepts the server's
	responses.  A client is part of a {client-server} software
	architecture.

	For example, a {workstation} requesting the contents of a file
	from a {file server} is a client of the file server.

	(1997-10-27)

that'd like to add a password retrieval system

1. The {supervisor} program or {operating system} on a
	computer.

	2. The entire computer system, including input/output devices,
	the {supervisor} program or {operating system} and possibly
	other {software}.

	3. Any large program.

	4. Any method or {algorithm}.

	[{Jargon File}]

to the
site. I'm having difficulties with the values never being the same.
Originally I tried encrypting with BLOWFISH, but that did not work for decrypt.
Here is the code

<software> Instructions for a computer in some programming
	language, often {machine language}.  The word "code" is often
	used to distinguish instructions from {data} (e.g. "The code
	is marked 'read-only'") whereas "{software}" is used in
	contrast with "{hardware}" and may consist of more than just
	code.

	(2000-04-08)

I have, so far:
APPLICATION.CFM:
<CFSET request.cryptAlgorithm = "DESEDE">
<CFSET request.cryptEncoding = "HEX">
<CFSET request.cryptKey = GenerateSecretKey(request.cryptAlgorithm)>
<CFSET request.cryptPhrase = "Eightcha">

LOGIN

1. An {object-oriented} {deductive language} and {database}
	system integrating {logic programming} and {inheritance}.

	["LOGIN: A Logic Programming Language with Built-In
	Inheritance", H. Ait-Kaci et al, J Logic Programming
	3(3):185-215 (1986)].

ACTION.CFM
<CFSET session.user.password =
URLEncodedFormat(Encrypt("#trim(form.password)#", request.cryptKey,
request.cryptAlgorithm)) />
<CFSET session.user.SQLpassword =
trim(replace(session.user.password,"'","''","all")) />
<CFQUERY name="checkLogin" dbtype="odbc" datasource="#request.data_source

<language, programming> (Or "source", or rarely "source
	language") The form in which a computer program is written by
	the programmer.  Source code is written in some formal
	programming language which can be compiled automatically into
	{object code} or {machine code} or executed by an
	{interpreter}.

	(1995-01-05)

#">
EXEC

/eg-zek'/ <operating system> 1. execute.

	A synonym for {chain} derived from the {Unix} "exec" {system
	call}.

	{Unix manual page}: execve(2).

	2. (Obsolete) {executive}.

	The mainstream "exec" as an abbreviation for (human) executive
	is *not* used.  To a hacker, an "exec" is a always a program,
	never a person.

	3. At {IBM} and {VM}/{CMS} shops, the equivalent of a {shell}
	command file.

	4. <operating system> The innermost {kernel} of the {Amiga}
	{operating system} which provides shared-library support,
	device interface, {memory management}, {CPU} management, basic
	{IPC}, and the basic structures for OS extension.  The rest of
	the Amiga OS (windowing, file system, third-party extensions,
	etc.) is built using these structures.

	[{Jargon File}]

	(1997-08-01)

check_login @xxxxxxxxxxx='#trim(session.user.username)#',
@xxxxxxxxxxx='#trim(session.user.SQLpassword)#'
</CFQUERY>
<CFDUMP var="#checkLogin#"><CFABORT>

I'm dumping the results of the query

1. <database, information science> A user's (or {agent}'s)
	request for information, generally as a formal request to a
	{database} or {search engine}.

	{SQL} is the most common {database query language}.

	2. <character> {question mark}.

	(1997-04-09)

and aborting to view the values; the
password is always changing. How can I keep the value always the same?

Thanks,

^_^

From: GArlington

Date: Wednesday, October 24, 2007

wrote in message:

Hello, all.
In the past, I always used HASH to encrypt the password for users; all I
needed to do was to check the HASHed value from login and compare to what is in
the db - simple.
Now I have a client that'd like to add a password retrieval system to the
site. I'm having difficulties with the values never being the same.
Originally I tried encrypting with BLOWFISH, but that did not work for decrypt.
Here is the code I have, so far:
APPLICATION.CFM:
<CFSET request.cryptAlgorithm = "DESEDE">
<CFSET request.cryptEncoding = "HEX">
<CFSET request.cryptKey = GenerateSecretKey(request.cryptAlgorithm)>
<CFSET request.cryptPhrase = "Eightcha">
LOGINACTION.CFM
<CFSET session.user.password =
URLEncodedFormat(Encrypt("#trim(form.password)#", request.cryptKey,
request.cryptAlgorithm)) />
<CFSET session.user.SQLpassword =
trim(replace(session.user.password,"'","''","all")) />
<CFQUERY name="checkLogin" dbtype="odbc" datasource="#request.data_source#">
EXEC check_login @xxxxxxxxxxx='#trim(session.user.username)#',
@xxxxxxxxxxx='#trim(session.user.SQLpassword)#'
</CFQUERY>
<CFDUMP var="#checkLogin#"><CFABORT>
I'm dumping the results of the query and aborting to view the values; the
password is always changing. How can I keep the value always the same?
Thanks,
^_^

On most systems password retrieval is actually a two step process

1. <operating system, software> The sequence of states of an
	executing {program}.  A process consists of the program {code}
	(which may be shared with other processes which are executing
	the same program), private data, and the state of the
	{processor}, particularly the values in its {registers}.  It
	may have other associated resources such as a {process
	identifier}, open files, {CPU time} limits, {shared memory},
	{child processes}, and {signal handlers}.

	One process may, on some {platforms}, consist of many
	{threads}.  A {multitasking} {operating system} can run
	multiple processes {concurrently} or in {parallel}, and allows
	a process to spawn "child" processes.

	(2001-06-16)

	2. <business> The sequence of activities, people, and systems
	involved in carrying out some business or achieving some
	desired result.  E.g. software development process, project
	management process, configuration management process.

	(2001-06-16)

that
gives a user NEW random

1. Unpredictable (closest to mathematical definition); weird.
	"The system's been behaving pretty randomly."

	2. Assorted; undistinguished.  "Who was at the conference?"
	"Just a bunch of random business types."

	3. (pejorative) Frivolous; unproductive; undirected.  "He's
	just a random loser."

	4. Incoherent or inelegant; poorly chosen; not well organised.
	"The program has a random set of misfeatures."  "That's a
	random name for that function."  "Well, all the names were
	chosen pretty randomly."

	5. In no particular order, though {deterministic}.  "The I/O
	channels are in a pool, and when a file is opened one is
	chosen randomly."

	6. Arbitrary.  "It generates a random name for the scratch
	file."

	7. Gratuitously wrong, i.e. poorly done and for no good
	apparent reason.  For example, a program that handles file
	name defaulting in a particularly useless way, or an assembler
	routine that could easily have been coded using only three
	registers, but redundantly uses seven for values with
	non-overlapping lifetimes, so that no one else can invoke it
	without first saving four extra registers.  What {randomness}!

	8.  A random hacker; used particularly of high-school students
	who soak up computer time and generally get in the way.

	9.  Anyone who is not a hacker (or, sometimes, anyone not
	known to the hacker speaking).  "I went to the talk, but the
	audience was full of randoms asking bogus questions".

	10.  (occasional MIT usage) One who lives at Random Hall.  See
	also {J. Random}, {some random X}.

	[{Jargon File}]

	(1995-12-05)

system generated password, that they can
change later.

From: dacf

Date: Wednesday, October 24, 2007

Have you tried it without the URLEncodedFormat around form,password?

It does not seem necessary if the 'password' is coming from the form scope, and
will actually change a string

<programming> A sequence of {data} values, usually {bytes},
	which usually stand for {characters} (a "character string").
	The {mapping} between values and characters is determined by
	the {character set} which is itself specified implcitly or
	explicitly by the environment in which the string is being
	interpreted.

	The most common character set is {ASCII} but, since the late
	1990s, there has been increased interest in larger character
	sets such as {Unicode} where each character is represented by
	more than eight {bits}.

	Most programming languages consider strings (e.g.
	"124:shabooya:\n", "hello world") basically distinct from
	numbers which are typically stored in fixed-length {binary} or
	{floating-point} representation.

	A {bit string} is a sequence of {bits}.

	(1999-12-21)

if the password contains certain characters, see
the attached code (CF8).

Also, is the database

1. <database> One or more large structured sets of persistent
	data, usually associated with software to update and {query}
	the data.  A simple database might be a single file containing
	many {records}, each of which contains the same set of
	{fields} where each field is a certain fixed width.

	A database is one component of a {database management system}.

	See also {ANSI/SPARC Architecture}, {atomic}, {blob}, {data
	definition language}, {deductive database}, {distributed
	database}, {fourth generation language}, {functional
	database}, {object-oriented database}, {relational database}.

	{Carol E. Brown's tutorial
	(http://accounting.rutgers.edu/raw/aies/www.bus.orst.edu/faculty/brownc/lectures/db_tutor/db_tutor.htm)}.

	2. <hypertext> A collection of {nodes} managed and stored in
	one place and all accessible via the same {server}.  {Links}
	outside this are "external", and those inside are "internal".

	On the {World-Wide Web} this is called a {website}.

	3. All the facts and rules comprising a {logic programming}
	program.

	(2005-11-17)

doing any sort

1. <application, algorithm> To arrange a collection of items
	in some specified order.  The items - {records} in a file or
	data structures in memory - consist of one or more {fields} or
	members.  One of these fields is designated as the "sort key"
	which means the records will be ordered according to the value
	of that field.  Sometimes a sequence of key fields is
	specified such that if all earlier keys are equal then the
	later keys will be compared.  Within each field some ordering
	is imposed, e.g. ascending or descending numerical, {lexical
	ordering}, or date.

	Sorting is the subject of a great deal of study since it is a
	common operation which can consume a lot of computer time.
	There are many well-known sorting {algorithms} with different
	time and space behaviour and programming {complexity}.

	Examples are {quicksort}, {insertion sort}, {bubble sort},
	{heap sort}, and {tree sort}.  These employ many different
	data structures to store sorted data, such as {arrays},
	{linked lists}, and {binary trees}.

	2. <tool> The {Unix} utility program for sorting lines of
	files.

	{Unix manual page}: sort(1).

	(1997-02-12)

of encrypt/decrypt functionality? If so,
might want to check if the two match up in a kind of similar way to the code
attached.
<CFSET testVars = ["sometest", "d.if/chars", "?><eues", "%solf"]/>
<ul>
<CFLOOP array="#testVars#" index="testVar">
<li><CFOUTPUT>Orig: #testVar# ?= #URLEncodedFormat(testVar)#</CFOUTPUT></li>
</CFLOOP>
</ul>

From: WolfShade

Date: Wednesday, October 24, 2007

I have tried it both with and without the URLEncodedFormat(); with and without
defining the algorithm, the encoding; the same result every time - every click

<hardware> To press and release a {button} on a {mouse} or
	other {pointing device}.  This generates an {event}, also
	specifying the screen position, which is processed by the
	{window manager} or {application program}.  On a mouse with
	more than one button, the unqualified term usually implies
	pressing the left-most button (with the right index finger),
	other buttons would be qualified, e.g. "{right-click}".
	{Keyboard} modifiers may also be used, e.g. "shift-click",
	meaning to hold down the shift key on the keyboard while
	clicking the mouse button.

	If the mouse moves while the button is pressed then this is a
	{drag}.

	(1995-03-14)

of the submit button

1. <electronics> {push-button}.

	2. <operating system> A graphical representation of an
	electrical {push-button} appearing as part of a {graphical
	user interface}.  Moving the {mouse pointer} over the
	graphical button and pressing one of the physical mouse
	buttons starts some software action such as closing a window
	or deleting a file.

	See also {radio button}.

	(1997-07-07)

dumps the query result (including the query, itself) and
shows that the encrypted password value is never the same, twice. I will include

[{Usenet}] 1. To duplicate a portion (or whole) of another's
	message (typically with attribution to the source) in a reply
	or followup, for clarifying the context of one's response.
	See the discussion of inclusion styles under "Hacker Writing
	Style".

	2. [{C}] "#include <disclaimer.h>" has appeared in {sig
	blocks} to refer to a notional "standard {disclaimer} file".

	[{Jargon File}]

three results, here:

#1
EXEC check_login @xxxxxxxxxxx='administrator',
@xxxxxxxxxxx='0JD%2FDM%5C%3EH%25H%3AQ%20BI%5C%3CN3%3F%20P%20%20%0A'

#2
EXEC check_login @xxxxxxxxxxx='administrator',
@xxxxxxxxxxx='02M%3A%27NC%5BGH%3D75CSV%25VHF%2FBP%20%20%0A'

#3
EXEC check_login @xxxxxxxxxxx='administrator',
@xxxxxxxxxxx='0J%3D%2DDGS%3A%25%2C%21DR%3A%21%27O%2CWU4%3B%40%20%20%0A'

Now without the URLEncodedFormat():

#1
EXEC check_login @xxxxxxxxxxx='administrator', @xxxxxxxxxxx='0E Y,/@xxxxxxxxxxx^K"^ZGA(W00W@xxxxxxxxxxx@xxxxxxxxxxx'

#2
EXEC check_login @xxxxxxxxxxx='administrator', @xxxxxxxxxxx='0F@xxxxxxxxxxx;IP0''7K<I6,1?*I,MS/@xxxxxxxxxxx'

#3
EXEC check_login @xxxxxxxxxxx='administrator', @xxxxxxxxxxx='0/%EVXY@xxxxxxxxxxx&Y0?Y_7O#@xxxxxxxxxxx@xxxxxxxxxxx'

If you are familiar with proper encrypt/decrypt usage, could you please post
some sample

<digital signal processing> The result of measuring the
	amplitude of an analog signal at a specified time.  In
	{digital signal processing} a sample is a signed or unsigned
	number and the number of samples per second is called the
	{sample rate}.

	(2001-06-06)

code? I tried following the example in livedocs and that is not
working, either.

Thanks,

^_^

From: cf_dev2

Date: Wednesday, October 24, 2007

<CFSET request.cryptKey = GenerateSecretKey(request.cryptAlgorithm)>

It looks like the secretKey is changing on every request. When the key

1. <database> A value used to identify a {record} in a
	database, derived by applying some fixed function to the
	record.  The key is often simply one of the {fields} (a
	{column} if the database is considered as a table with records
	being rows, see "{key field}").  Alternatively the key may be
	obtained by applying some function, e.g. a {hash function}, to
	one or more of the fields.  The set of keys for all records
	forms an {index}.  Multiple indexes may be built for one
	database depending on how it is to be searched.

	2. <cryptography> A value which must be fed into the
	{algorithm} used to decode an encrypted message in order to
	reproduce the original {plain text}.  Some encryption schemes
	use the same (secret) key to encrypt and decrypt a message,
	but {public key encryption} uses a "private" (secret) key and
	a "public" key which is known by all parties.

	3. <hardware> An electromechanical {keyboard} button.

	(2003-07-04)

changes, the encrypted changes. To get the same value you must use the same
key.

From: WolfShade

Date: Wednesday, October 24, 2007

[q][i]Originally posted by: [b][b]cf_dev2[/b][/b][/i]
<CFSET request.cryptKey = GenerateSecretKey(request.cryptAlgorithm)>

It looks like the secretKey is changing on every request. When the key
changes, the encrypted value changes. To get the same encrypted value you must
use the same key.[/q]
That's what I thought. Originally I had used
[q]Encrypt("#form.password#","8charkey","BLOWFISH")[/q] to encrypt, but
could not get it to DEcrypt from that. Kept getting an error

1. A discrepancy between a computed, observed, or measured
	value or condition and the true, specified, or theoretically
	correct value or condition.

	2. <programming> A mental mistake made by a programmer that
	may result in a program {fault}.

	3. (verb) What a program does when it stops as result of a
	programming error.

	(2000-03-28)

that the input and
output

<architecture> {Data} transferred from a computer system to
	the outside world via some kind of {output device}.

	Opposite: {input}.

	(1997-04-28)

don't match. Do you know how to decrypt from the above encrypt?

^_^

From: cf_dev2

Date: Wednesday, October 24, 2007

Same concept. But again decrypt won't work if you're not using the same key
that was used to encrypt the string.

<CFSET cryptAlgorithm = "BLOWFISH">
<CFSET cryptKey = GenerateSecretKey(cryptAlgorithm)>
<CFSET form.password = "mypassword">

<CFSET encryptedPassword = Encrypt(form.password, cryptKey, cryptAlgorithm)>
<CFSET decryptedPassword = Decrypt(encryptedPassword, cryptKey,
cryptAlgorithm)>

<CFOUTPUT>
Form.Password = #form.password#[HR]
Encrypted = #encryptedPassword#[HR]
Decrypted = #decryptedPassword#[HR]
</CFOUTPUT>

From: WolfShade

Date: Wednesday, October 24, 2007

Could it be server

1. A program which provides some service to other ({client})
	programs.  The connection between client and server is
	normally by means of {message passing}, often over a
	{network}, and uses some {protocol} to encode the client's
	requests and the server's responses.  The server may run
	continuously (as a {daemon}), waiting for requests to arrive
	or it may be invoked by some higher level daemon which
	controls a number of specific servers ({inetd} on {Unix}).

	There are many servers associated with the {Internet}, such as
	those for {HTTP}, {Network File System}, {Network Information
	Service} (NIS), {Domain Name System} (DNS), {FTP}, {news},
	{finger}, {Network Time Protocol}.  On Unix, a long list can
	be found in /etc/services or in the {NIS} database "services".
	See {client-server}.

	2. A computer which provides some service for other computers
	connected to it via a network.  The most common example is a
	{file server} which has a local disk and services requests
	from remote clients to read and write files on that disk,
	often using {Sun}'s {Network File System} (NFS) {protocol} or
	{Novell Netware} on {PCs}.  Another common example is a {web
	server}.

	[{Jargon File}]

	(2003-12-29)

related? Microsoft

<company> The biggest supplier of {operating systems} and
	other software for {IBM PC} compatibles.  Software products
	include {MS-DOS}, {Microsoft Windows}, {Windows NT},
	{Microsoft Access}, {LAN Manager}, {MS Client}, {SQL Server},
	{Open Data Base Connectivity} (ODBC), {MS Mail}, and {SNA
	Server} for Windows NT.

	Microsoft was founded as "Micro-soft" in 1975 by {Bill Gates}
	(now CEO) and his high school pal Paul Allen.  Their first
	product was a version of {BASIC} for the new {Altair} computer
	[which one?].  In 1980, {IBM} chose Microsoft to supply the
	{operating system} for the {IBM PC}.

	On the UK television program "The Net" in May 1994, {Bill
	Gates} said he was betting his company on the {information
	highway}".

	Quarterly sales $1293M, profits $362M (Aug 1994).

	{Home (http://www.microsoft.com/)}.
	{(ftp://ftp.microsoft.com/)}.

	{Interesting Info and Other Microsoft WWW Servers
	(http://www-drg.microsoft.com/devinfo.htm)}.

	{Microsoft Windows Developer Information
	(http://www-drg.microsoft.com/devinfo.htm)}.

	{Microsoft Research Group Information
	(http://www.research.microsoft.com)}.

	{Win_News
	(http://www.microsoft.com/chicago/ms-www/ms-intro.htm)}.
	maintained by the Personal Operating Systems Division to
	distribute information on {Microsoft Windows}, {MS-DOS} and
	{Windows 95}.

	(1998-11-06)

Windows

<operating system> See {Microsoft Windows}, {Windows NT}.

	(1997-11-23)

Server 2003 and CF8.

application.CFM
[h]
<CFSET request.cryptAlgorithm = "BLOWFISH">
<CFSET request.cryptKey = GenerateSecretKey(request.cryptAlgorithm)>
[/h]

loginaction.CFM
[h]
<CFSET session.user.username = trim(form.username) />
<CFSET session.user.password = Encrypt(trim(form.password), request.cryptKey,
request.cryptAlgorithm) />
<CFSET session.user.SQLpassword = session.user.password />
<CFQUERY name="checkLogin" dbtype="odbc" datasource="#request.data_source#">
EXEC cpwr_adm_check_login @xxxxxxxxxxx='#session.user.username#',
@xxxxxxxxxxx='#trim(session.user.SQLpassword)#'
</CFQUERY>
<CFDUMP var="#checkLogin#"><CFABORT>
[/h]
I'm still getting the same result; different output each time.

@xxxxxxxxxxx='08!4[BP%=M!</[JW)/TF! P'

@xxxxxxxxxxx='0C4X\TE.DZKG62]?''F-7ZD@xxxxxxxxxxx'

@xxxxxxxxxxx='0P8%&LU##?L:%Q("7Q4M2.@xxxxxxxxxxx'

?
^_^

From: cf_dev2

Date: Wednesday, October 24, 2007

I'm still getting the same result; different output each time.

You're still changing the secretKey on every request. Different key == different encrypted string.

From: cf_dev2

Date: Wednesday, October 24, 2007

Btw, I have no idea what your stored procedure

<programming> (Or "procedure") A sequence of {instructions}
	for performing a particular task.  Most programming languages,
	including most {machine languages}, allow the programmer to
	define subroutines.  This allows the subroutine code to be
	called from multiple places, even from within itself (in which
	case it is called {recursive}).  The programming language
	implementation takes care of returning control to (just after)
	the calling location, usually with the support of call and
	return instructions at {machine language} level.

	Most languages also allow {arguments} to be passed to the
	subroutine, and one, or occasionally more, {return values} to
	be passed back.

	A {function} is often very similar to a subroutine, the main
	difference being that it is called chiefly for its return
	value, rather than for any {side effects}.

	(1996-10-01)

is doing :)

From: WolfShade

Date: Wednesday, October 24, 2007

So GenerateSecretKey() gives a different output each time it's run

<operating system, programming> The process of carrying out
	the {instructions} in a computer program by a computer.

	See also {dry run}.

	(1996-05-13)

. Do I *have* to use GenerateSecretKey() in order to decrypt?

^_^

From: cf_dev2

Date: Wednesday, October 24, 2007

So GenerateSecretKey() gives a different output each time it's run.

Yes

> Do I *have* to use GenerateSecretKey() in order to decrypt?

When you a [i]key[/i] to Encrypt(), then yes you must use that same key to
Decrypt(). Note, that does not mean calling GenerateSecretKey() inside
Decrypt(). It means saving the key value and passing the saved key to
Decrypt().

You do not [i]have[/i] to use a key at all. You could simply do this

<CFSET encryptedPassword = Encrypt(form.password, cryptAlgorithm)>
<CFSET decryptedPassword = Decrypt(encryptedPassword, cryptAlgorithm)>

From: cf_dev2

Date: Wednesday, October 24, 2007

You do not have to use a key at all.

Scratch that. If you do not use a key I think it'll default to CFMX_COMPAT, which isn't what you want.

From: WolfShade

Date: Wednesday, October 24, 2007

I have NO idea what just happened. The first time I tried encrypting and
decrypting without using GenerateSecretKey() it errored. Now it's not.

%^/

I'm not going to question it. I'm just going to accept

<library, networking> {Berkeley} {Unix} networking {socket}
	library routine to satisfy a connection request from a remote
	{host}.  A specified socket on the local host (which must be
	capable of accepting the connection) is connected to the
	requesting socket on the remote host.  The remote socket's
	socket address is returned.

	{Unix manual pages}: accept(2), connect(2).

	(1994-11-08)

it. I'll keep
telling myself, "It does not matter, it works. It does not matter, it works."

Thanks for your help. Feel

(Free and Eventually Eulisp) An initial implementation of an
	{EuLisp} {interpreter} by Pete Broadbery
	<pab@maths.bath.ac.uk>.  Version 0.75 features an integrated
	{object} system, {modules}, {parallelism}, interfaces to {PVM}
	library, {TCP/IP} {sockets}, {futures}, {Linda} and {CSP}.
	Portable to most {Unix} systems.  Can use {shared memory} and
	{threads} if available.

	{(ftp://ftp.bath.ac.uk/pub/eulisp/)}.

	(1992-09-14)

bad about wasting your time, like that.

^_^

From: cf_dev2

Date: Wednesday, October 24, 2007

No. See my last comment. If you do not use a key I think it will ColdFusion

<World-Wide Web, database, tool> {Allaire Corporation}'s
	commercial {database} application development tool that allows
	{databases} to have a {World-Wide Web} {interface}, so a
	database can be queried and updated using a {web browser}.

	The ColdFusion Server application runs on the {web server} and
	has access to a {database}.  ColdFusion files on the web
	server are {HTML} pages with additional ColdFusion commands to
	{query} or {update} the database, written in {CFML}.  When the
	page is requested by the user, the {web server} passes the
	page to the Cold Fusion application, which executes the {CFML}
	commands, places the results of the {CFML} commands in the
	{HTML} file, and returns the page to the {web server}.  The
	page returned to the {web server} is now an ordinary {HTML}
	file, and it is sent to the user.

	Examples of ColdFusion applications include order entry, event
	registration, catalogue search, directories, calendars, and
	interactive training.  ColdFusion applications are robust
	because all database interactions are encapsulated in a single
	industrial-strength {CGI} script.  The formatting and
	presentation can be modified and revised at any time (as
	opposed to having to edit and recompile {source code}).

	ColdFusion Server can connect with any database that supports
	{ODBC} or {OLE DB} or one that has a native database driver.
	Native database drivers are available for {Oracle} and
	{Sybase} databases.

	ColdFusion is available for {Windows}, {Solaris}, and {HP-UX}.
	A {development environment} for creating ColdFusion files,
	called ColdFusion Studio, is also available for {Windows}.

	Current version: MX(6), as of 2003-07-11.

	The {filename extension} for ColdFusion files is .cfm

	{Home (http://www.coldfusion.com/)}.

	(2003-07-27)

uses CFMX_COMPAT which is [b]not[/b] the same as using BLOWFISH.

From: WolfShade

Date: Wednesday, October 24, 2007

That's just it. I am using a key, and using BLOWFISH. Why it's working, now,
I do not know; but it was not, before.

application.CFM
<CFSET request.cryptAlgorithm = "BLOWFISH" />
<CFSET request.cryptKey = "16characterskey1" />

loginaction.CFM
<CFSET session.user.username = trim(form.username) />
<CFSET session.user.password = Encrypt(trim(form.password), request.cryptKey,
request.cryptAlgorithm) />
<CFSET session.user.SQLpassword = session.user.password />
<CFQUERY name="checkLogin" dbtype="odbc" datasource="#request.data_source#">
EXEC check_login @xxxxxxxxxxx='#session.user.username#',
@xxxxxxxxxxx='#trim(session.user.SQLpassword)#'
</CFQUERY>
<CFOUTPUT>password is #Decrypt(session.user.SQLpassword, request.cryptKey,
request.cryptAlgorithm)#</CFOUTPUT>
<CFDUMP var="#checkLogin#"><CFABORT>

I'm stumped, but not questioning it. It is working, now. (shrug) Without
GenerateSecretKey().

Thanks,

^_^

From: WolfShade

Date: Wednesday, October 24, 2007

Okay.. I spoke too soon. It works ON THAT PAGE. As soon as I attempt to
decrypt on another page after pulling the password from the database, it errors.

An error occurred while trying to encrypt or decrypt your input string: The
input and output encodings aren't same..

<CFOUTPUT>Password for this account is #Decrypt(getAdmin.userPW,
request.cryptKey, request.cryptAlgorithm)#</CFOUTPUT>

AFAIK, the database is not changing anything and the datatype is nvarchar(100).
Any idea as to what I'm missing, this time?

^_^

From: cf_dev2

Date: Wednesday, October 24, 2007

First I'd recommend creating an example that strips the code to its
simplest form (ie. no trim(), urlencodedformat(), etc.) Just to ensure you
have not inadvertently changed the values somehow.

Next, what about dacf's suggestion? Did you output the two values and see if
they're different? ie. output the encrypted ColdFusion string and the string from your
database query.

From: WolfShade

Date: Wednesday, October 24, 2007

Okay.. here's what I have got, currently:
STORED PROCEDURE:
CREATE PROCEDURE dbo.check_login
@xxxxxxxxxxx nvarchar(50),
@xxxxxxxxxxx nvarchar(100)
AS

DECLARE @xxxxxxxxxxx int
SET

A collection of objects, known as the elements of the set,
	specified in such a way that we can tell in principle whether
	or not a given object belongs to it.  E.g. the set of all prime
	numbers, the set of zeros of the cosine function.

	For each set there is a {predicate} (or property) which is
	true for (possessed by) exactly those objects which are
	elements of the set.  The predicate may be defined by the set
	or vice versa.  Order and repetition of elements within the
	set are irrelevant so, for example, {1, 2, 3} = {3, 2, 1} =
	{1, 3, 1, 2, 2}.

	Some common set of numbers are given the following names:

	N = the {natural numbers} 0, 1, 2, ...

	Z = the {integers} ..., -2, -1, 0, 1, 2, ...

	Q = the {rational numbers} p/q where p, q are in Z and q /= 0.

	R = the {real numbers}

	C = the {complex numbers}.

	The empty set is the set with no elements.  The intersection
	of two sets X and Y is the set containing all the elements x
	such that x is in X and x is in Y.  The union of two sets is
	the set containing all the elements x such that x is in X or x
	is in Y.

	See also {set complement}.

	(1995-01-24)

@xxxxxxxxxxx='0'
IF EXISTS (
SELECT [adminID]
FROM [cpwr_org_01].[dbo].[cpwr_admin_users]
WHERE [userName] = @xxxxxxxxxxx AND [userPW] = @xxxxxxxxxxx
)
BEGIN
SET @xxxxxxxxxxx='1'

SELECT [adminID], [firstName], [lastName], [userName], [userLevel],
[datecreated], [lastLogin], [isActive], @xxxxxxxxxxx as statusCode, [userPW]
FROM [cpwr_org_01].[dbo].[cpwr_admin_users]
WHERE [userName] = @xxxxxxxxxxx AND [userPW] = @xxxxxxxxxxx AND [isActive] = 1
END
ELSE
BEGIN
SELECT @xxxxxxxxxxx as statusCode
END

IF (@xxxxxxxxxxx = '1')
BEGIN

UPDATE [cpwr_org_01].[dbo].[cpwr_admin_users]
SET [lastLogin] = getdate()
WHERE [userName] = @xxxxxxxxxxx AND [userPW] = @xxxxxxxxxxx

END
GO

APPLICATION.CFM
<CFSET request.cryptAlgorithm = "BLOWFISH" />
<CFSET request.cryptKey = "8charkey" />

LOGINACTION.CFM
<CFSET session.user.username = trim(form.username) />
<CFSET session.user.password = Encrypt(trim(form.password), request.cryptKey,
request.cryptAlgorithm) />
<CFSET session.user.SQLpassword = session.user.password />
<CFQUERY name="checkLogin" dbtype="odbc" datasource="#request.data_source#">
EXEC cpwr_adm_check_login @xxxxxxxxxxx='#session.user.username#',
@xxxxxxxxxxx='#trim(session.user.SQLpassword)#'
</CFQUERY>
direct encrypted pw is <CFDUMP var="#session.user.SQLpassword#"><br>
db retrieved pw is <CFDUMP var="#checkLogin.userPW#">

This is what displays when I run the page:
direct encrypted pw is 0L42&E!R11!?XN3Z#X#$J;
db retrieved pw is 0L42&E!R11!?XN3Z#X#$J;

According to this, they are identical. But when I run the other page that
attempts to decrypt, I get this:
An error occurred while trying to encrypt or decrypt your input string: The
input and output encodings aren't same..
72: Password for this account is #Decrypt(getAdmin.userPW, request.cryptKey,
request.cryptAlgorithm)#

STORED PROCEDURE:
CREATE PROCEDURE dbo.get_admin_edit
@xxxxxxxxxxx int
AS

SELECT [adminID], [firstName], [lastName], [userName], [userPW], [userLevel],
[datecreated], [lastLogin], [isActive], [userEmail]
FROM [cpwr_org_01].[dbo].[cpwr_admin_users]
WHERE adminID = @xxxxxxxxxxx
GO

EDIT PAGE:
Password for this account is #Decrypt(getAdmin.userPW, request.cryptKey,
request.cryptAlgorithm)#

^_^

From: cf_dev2

Date: Wednesday, October 24, 2007

strips the code to its simplest form (ie. no trim(), urlencodedformat(), etc

> @xxxxxxxxxxx='#trim(session.user.SQLpassword)#'

It looks like you have still got some excess code in their (ie trim() calls) and
I think that's what's messing you up. Try removing the trim() calls.

Generally speaking, once you encrypt the value, you do not want to change the
encrypted string in any way because encrypt/decrypt are extremely sensitive.

> According to this, they are identical.
Looks can be deceiving ;) You can always use compare() to verify that two
strings actually are identical.

Btw, why are you using CFQUERY to run your stored procedures instead of
CFSTOREDPROC?

From: WolfShade

Date: Wednesday, October 24, 2007

CFQ vs CFSP - (shrug) Habit, really, I guess. When I first started learning ColdFusion in 2000, I just used CFQ and never got around to using CFSP.

I will remove the trim(), but I'm paranoid about that. I have always trimmed the
strings prior to db insert; and I always use trim() when displaying. I have had
too many times where a comparison did not match because of a lack of trim().

I will also try the compare to see if there is any difference. Thanks for the
idea.

^_^

From: cf_dev2

Date: Wednesday, October 24, 2007

Ah, okay.

Yes, I agree with you that values should be trimmed. But assuming you have used
Encrypt(trim(form.password),...) there's no need to use trim() again on the
encrypted string. Its probably changing the value.

From: WolfShade

Date: Wednesday, October 24, 2007

Without trim(), it's throwing a blank space

<character> The space character, {ASCII} 32.

	See {octal forty}.

on the end of the encrypted
password being submitted by the form. Even if I add the " " to the end of the
password in the database, it still comes back as user does not exist. Since the
user does not exist, it's not returning the password for compare() to check. :(

^_^

From: cf_dev2

Date: Wednesday, October 24, 2007

I do not know if its a literal

<programming> A constant made available to a process, by
	inclusion in the executable text.  Most modern systems do not
	allow texts to modify themselves during execution, so literals
	are indeed constant; their value is written at compile-time
	and is read-only at run time.

	In contrast, values placed in variables or files and accessed
	by the process via a symbolic name, can be changed during
	execution.  This may be an asset.  For example, messages can
	be given in a choice of languages by placing the translation
	in a file.

	Literals are used when such modification is not desired.  The
	name of the file mentioned above (not its content), or a
	physical constant such as 3.14159, might be coded as a
	literal.  Literals can be accessed quickly, a potential
	advantage of their use.

	(1996-01-23)

space but if that's how the value is encrypted,
its fine. Just leave the string as is. Decrypt will handle

1. <programming, operating system> A simple item of data that
	identifies a resource.  For example, a {Unix} file handle
	identifies an open file and associated data such as whether it
	was opened for read or write and the current read/write
	position.  On the {Macintosh}, a handle is a pointer to a
	pointer to some dynamically-allocated memory.  The extra level
	of indirection allows on-the-fly {memory compaction} or
	{garbage collection} without invalidating application program
	references to the allocated memory.

	2. <jargon> An alias used intended to conceal a user's true
	identity in an electronic message.  The term is common on
	Citizen's Band and other amateur radio but, in that context
	usually means the user's real name as {FCC} rules forbid
	concealing one's identity.

	Use of grandiose handles is characteristic of {crackers},
	{weenies}, {spods}, and other lower forms of network life;
	true hackers travel on their own reputations.

	Compare {nick}.

	[{Jargon File}]

	(2004-07-20)

it. In other
words, once you have called encrypt() do not change the value in any way. I tried
a quick test and it worked fine for me, so I suspect trim() might be the source
of the problem.

From: WolfShade

Date: Wednesday, October 24, 2007

But I have removed the trim() from anywhere outside the Encrypt() tag

<language, text> An {SGML}, {HTML}, or {XML} {token}
	representing the beginning (start tag: "<p ...>") or end (end
	tag: "</p>") of an {element}.  In normal SGML {syntax} (and
	always in {XML}), a tag starts with a "<" and ends with an
	">".

	In {HTML} jargon, the term "tag" is often used for an
	"{element}".

	(2001-01-31)

for
password.

<CFSET session.user.username = trim(form.username) />
<CFSET session.user.password = Encrypt(trim(form.password), request.cryptKey,
request.cryptAlgorithm) />
<CFSET session.user.SQLpassword = session.user.password />
<CFQUERY name="checkLogin" dbtype="odbc" datasource="#request.data_source#">
EXEC cpwr_adm_check_login @xxxxxxxxxxx='#session.user.username#',
@xxxxxxxxxxx='#session.user.password#'
</CFQUERY>
<CFDUMP var="#checkLogin#">
direct encrypted pw is <CFDUMP var="#session.user.SQLpassword#"><br>
db retrieved pw is <CFDUMP var="#checkLogin.userPW#">[h]<-- Error here, no
records returned because no match[/h]
<CFOUTPUT>
direct password is #Decrypt(session.user.SQLpassword, request.cryptKey,
request.cryptAlgorithm)#
database password is #Decrypt(checkLogin.userPW, request.cryptKey,
request.cryptAlgorithm)#
Comparison = #compare(session.user.SQLpassword,checkLogin.userPW)#

^_^

From: cf_dev2

Date: Wednesday, October 24, 2007

What about when the password is first inserted? Try it with a completely new password.

In my tests it seems to be working fine every time. So maybe the existing values were stored incorrectly?

From: WolfShade

Date: Wednesday, October 24, 2007

Och. That will take some time. I have not created the user add/edit form, yet.
:( And I have got other things that have to be finished by tomorrow morning.

I will get that done ASAP afterwards, though, and let you know if that made any
difference.

Thanks, again, for your thoughts and advice.

^_^

From: cf_dev2

Date: Wednesday, October 24, 2007

Okay. I will check back later on to see how you made out.

Next Message: PDFLib Cold Fusion example

Blogs related to Encrypt / Decrypt help

Still having problems with encrypt
We had a similar problem with both our Java and CF encrypt/decrypt code. We found that our MS-SQL server was being "helpful" and converting, trimming or otherwise manipulating the string we sent in. We took an additional step and base64 ...

Still having problems with encrypt - CFusion_Encrypt() Works!
This works great (out of the 20 or so test I've done so far: Why encrypt/decrypt isn't working correctly is totally beyond my understanding. ...

encrypt/decrypt bug
I can't tell if the problem is on the encrypt or decrypt side either. During these test, the var "encCODE" was kept constant. I haven't tried yet, but wonder if changing it would make a difference. Will try that next. ...

encrypt/decrypt bug
Hi Les, I've seen similar behavior most typically when I'm also urlencoding the the encrypted value. What I figured out was happening is that if the encrypted value contained a space, when urlencodedformat() was run ...

encrypt/decrypt bug
Could you post the entire encrypt/decrypt code snip? -----Original Message----- From: Les Mizzell [mailto:lesmizz@bellsouth.net] Sent: Friday, April 27, 2007 11:45 AM To: CF-Talk Subject: encrypt/decrypt bug This is driving me crazy! ...

Stop View Source
You're not talking about the CFML code, are you? It IS possible to encrypt your ColdFusion code in the .cfm files, but I that can be decrypted as well back into Java by anyone with access to the web server. ...