Would you, please, take your eyes OFF my sensitive data?!

• Download WouldYouPleaseEyesOFF_demo - 57.73 KB
• Download WouldYouPleaseEyesOFF_src - 53.75 KB

Preamble

I was rude!...
I know I was, when I said that...
but I had to say it!
That young and pretty beautiful lady was looking straight to my sensitive data!...
and we were in public...
at an internet cafe,
and my sensitive data was fully shown on the display screen!...
completely unprotected!
Fortunately, my data is large enough to be understood at first sight.

Whenever that beautiful lady's image comes to my mind, I only think in one thing...

Introduction

My obvious conclusion out of this fact was that I should design a C++ class (MFC dependent) to protect any data from prying (although very attractive) eyes... and this is exactly what I've did.

I've implemented a simple class, named Symmetric, inside a namespace named Encryption, to symmetrically encrypt/decrypt an array of bytes held by an object of type CArray<BYTE>, given a key in a form of another array of bytes, also held by an object of this same type.

This Symmetric class holds only 2 public methods:

void Encrypt(CArray<BYTE>& data
    ,  const CArray<BYTE>& key
    ,  const BOOL          throwException = _dontThrowException)
{
    //
    // code to throw or not exception...
    //
    Do(_encryption, data, key);
}

void Decrypt(CArray<BYTE>& data
    ,  const CArray<BYTE>& key
    ,  const BOOL          throwException = _dontThrowException)
{
    //
    // code to throw or not exception...
    //
    Do(_decryption, data, key);
}

The encryption/decryption is made in place, i.e., directly on the data object instance (no copy of it is made).

Any memory used for holding the key (or part of it) is, after usage, securely zeroed.

The key used to encrypt the data, makes no part of the encrypted data

Also, the encrypted data is always 8 bytes greater than the original data, for producing some avalanche effect in the encryption data, avoiding quite similar datas having almost the same encrypted result.

The Symmetric class deals with a zero-length key and/or a zero-length data, without needing to throw exceptions.

An object instantiated from Symmetric class can encrypt/decrypt any data held in a CArray<BYTE> object, no matter its size.
Is your sensitive data a small one ( ) ?... no problem, the Symmetric class remedies this.
It can encrypt even a zero-length data, and decrypt it back correctly, that is, back to a zero-length data.

Also, a zero-length key can encrypt (the word is inappropriate in this case, because there's no scrambling) and decrypt back correctly, any data.

The Symmetric class can also, encrypt a zero-length data with a zero-length key (now, both arrays are zero-length), and decrypt it back correctly to a zero-length data.
It's apparent that this class doesn't need to throw exception of any type.

An example using this class for encryption is:

   CArray<BYTE> key;
   DefineYourKey(key);
   CArray<BYTE> data;
   ReadYourDataFromAFileForInstance(data);

   Encryption::Symmetric().Encrypt(data, key);
   //now, data is encrypted.

   PutYourEncryptedDataBack(data);

And, for decryption:

  CArray<BYTE> key;
  UseTheSameKeyAsBefore(key);
  CArray<BYTE> data;
  ReadBackYourEncryptedData(data);

  Encryption::Symmetric().Decrypt(data, key);
  //now, data is as the original one.

Sometimes, a client application wants to be warned about inappropriate argument; exceptions are useful in this case, while maintaining programming linearity:

   try
   {
        /*©*/ using namespace Encryption;
        Symmetric().Encrypt(abDATA, abKEY, _andThrowExceptionIfAnyArgumentIsZeroLength);
        // 
        // etc...
        // 
    }
    catch (INT_PTR check)
    {
	CString checkString = /*©*/ Encryption::GetCheckString(check);
        // 
        // etc...
        // 
    }

For better appreciating some visual effects when running the executable zipped above, do it using the command line in the start up menu. Also, if you have another window shown up, it would be better let it cover no more than 50% of screen real estate, and don't forget that the file THE Lady.encrypted.dat must be in the same folder.

Background

Just basic MFC programming knowledge.

Building the Project

The MFC dependent Encryption namespace (containing the Symmetric class) is declared and implemented in the Encryption header file.

This article's project is an MFC one that makes no use of pre-compiled headers, and has got three files besides the one already mentioned: a .cpp for the application, mainframe (and its CRichEditCtrl derived child window), and dialog box classes, and a .h and a .rc for resources.

The character set is not set.

The Code

In the client application, a CRichEditCtrl derived child window is used as repository for the examples' results. A modal dialog box is used solely to collect user input and, as we know that it doesn't block the main window, send messages to the it, which will react accordingly, performing tests and showing them on screen.

The main method in the Symmetric class is Do(const BOOL encrypt, ...), which performs the encryption or decryption, depending on the BOOL parameter, while keeping the correct execution order (when decrypting, the order must be reversed in relation to encrypting).

The Symmetric::TheAvalanche(...) method increases the data length by 8 bytes (exclusively dependent on the data and on the key) to produce an avalanche effect, that makes similar datas having reasonably different encrypted datas.

The user key is not directly used to encrypt (or decrypt) the data. Instead, many keys are built from it, with lengths varying from 1 up to the original key length, and repeating the same process, but now using the original key reversed.

For instance, a key like ABC (hex 41 42 43), will cause the data be encrypted (or decrypted) with the following keys in sequence (but when decrypting, the sequence order is reversed):

41 b1 a5 02 
41 42 64 4e 7e 04 
41 42 43 6b 29 6b 85 81 07 
14 e4 a5 02 
14 24 02 1b 18 04 
14 24 34 0d 09 65 a7 e7 07 

Note that the bytes 14, 24 and 34 above are the originals 41, 42 and 43 with the nibbles reversed. The other bytes are calculated based only on the key itself.

Points of Interest

Maybe, the weakest part in an encrypted system is not the encryption algorithm, but, the key a user chooses to encrypt his/her data. For instance, a key like:

Qwerty

or

qazxsw

or

bored web developer

will never, ever, protect any data from any hacker, no matter how smart and strong the encryption algorithm is.
Those words are in every hacker's dictionary for attacking a system security.
The first two keys are directly found (any specific sequence) on the keyboard, and the last one is composed of three words directly found in a language dictionary and, worse, they are english words, which is an international language.
Therefore, we should litter them ( please, just the keys, not the person, because it's against human civil rights ).

To choose a key is easy; to choose a strong key is a bit harder; to remember such a key is the hardest thing.
Maybe one would choose strong keys and, later, would choose to pack them all in a file encrypted with an easy key to remember later... .

Point of very much interest

I'm very much interested in meeting that young and pretty beautiful lady again.

If you happen to see her somewhere, just let me know! This is the point.
Right now, after implementing Symmetric class, I feel confident to show her my sensitive data...
...and I'd like very much she'd let me see her sensitive data too!

History

11/november/2008 : just decided start looking for that beautiful lady... .

Postamble

By the way, let me tell you that I've just met,

AGAIN,

that pretty beautiful lady.

Yeaaah!

Acknowledgment

I must acknowledge the great oil painting artist Maria Teresa Meneses, whose from one of her works I've borrowed some pixel colors for writing a lady in the CRichEditCtrl derived child window.

You must Sign In to use this message board.

FAQ    Noise Tolerance Very HighHighMediumLowVery Low   Layout Expand Posts & RepliesThread ViewNo JavascriptNo JS + Preview   Per page 102550

Msgs 1 to 12 of 12 (Total in Forum: 12) (Refresh) FirstPrevNext

My vote of 2 Jeffrey Walton 10:12 25 Mar '09   Could stand to go to finishing school Sign In·View Thread·PermaLink Re: My vote of 2 aljodav 8:46 26 Mar '09   I did! See this: Jeffrey Walton wrote: ...to go to finishing... you are using the gerundial form, therefore don't use the preposition 'to'. Haven't you learned that? Jeffrey Walton DID NOT wrote: . Where is the full stop ending your sentence? Were your eyes glassy and your brain clouded by some smoke ? In your (unfinished) sentence, I counted 7 words, ZERO full stop, and 2 errors, i.e., 26% of errors! If I go back to school, and I choose the same one as yours, I'm sure they'll ask me to be a professor. It will my pleasure to have you as my pupil, Mr. 26% ! If, as a pupil, you ask me a good example using the preposition to, I will cite the informal expression: go to hell. This is a perfect example to you and, please, note that I have included the full stop as a bonus to illustrate you better. P.S.: I don't smoke. My eyes are vivid, my brain is clean, and my lungs are healthy. Cigarettes, cigars, and similars are unhealthy. • Sign In·View Thread·PermaLink Lady? Jose M. Menendez Poó 13:32 11 Nov '08   I just don't get the lady analogy. Jm www.menendezpoo.com Sign In·View Thread·PermaLink Ah...did you mean... NGS 549672 6:27 11 Nov '08   sensitive data? Sensible data makes no sense. Sign In·View Thread·PermaLink 5.00/5 (1 vote) Re: Ah...did you mean... aljodav 13:22 11 Nov '08   Just corrected. Thanks. Sign In·View Thread·PermaLink Style Dmitri Nesteruk 0:45 11 Nov '08   I strongly recommend you adjust your writing style before publishing further articles here on CP. Sign In·View Thread·PermaLink 2.45/5 (4 votes) Re: Style aljodav 20:24 11 Nov '08   My little dear, I see you are so... so... sad, so... so... unable to make me any recommendation. What will you do about it? I'm not gonna change my style, my little dear. Sign In·View Thread·PermaLink Re: Style KenThompson 13:04 12 Nov '08   A narrative can be appropriate in certain cases. However, it doesn't do well in replace of actual content. Also, insulting someone who has given you some constructive criticism will not win you many fans. Sign In·View Thread·PermaLink Re: Style aljodav 19:36 12 Nov '08   KenThompson wrote: A narrative can be appropriate in certain cases. You're wrong. The narrative style is appropriate always, but it doesn't mean that it is the most appropriate. Many times it is, many others it isn't. KenThompson wrote: However, it doesn't do well in replace of actual content. You're wrong in my opinion; some will agree with you, others will not. This is very subjective. KenThompson wrote: Also, insulting someone... You're wrong again. I consider that person unable to give me recommendation; this is fact, not insult. It is a complete absurd having complete stranger recommending me anything. That person is a complete stranger to me. Is that person trying to change the world? I will not change my behavior, will you? KenThompson wrote: ...who has given you some constructive criticism... Once more you're wrong. Placing a message with a rant is not constructive criticism. It is a rant, directed to me, and we have never exchanged any message. There's a report button that can be used. I do not accept recommendation from anyone I have not asked for; let alone from a complete stranger to me; let alone a strong recommendation from a complete stranger. Should I consider a such recommendation, with a rant, a threat? What if I don't follow the strong recommendation ? What will that person do about it ? Probably that person is not emotionally matured enough to know how to deal with adults. You don't mention the strong recommendation as a insult. Shall I consider that you would accept such words quiet and nicely? Ahn? No, I don't. KenThompson wrote: will not win you many fans. You're right. I'm not star (and I will not be), I'm not guru (and I will not be), so I don't look for fans. What I look for are new friends; persons like me that we can exchange valuable non-material things. By the way, are you both friends or related some way, that made to post a message to me? Why did you post a message that it's not related to the article? Ahn? I consider your message not related to the article, therefore, inappropriate. Never mind answering any question; I just don't wanna know anything that is not related to the article. Have a nice day. Sign In·View Thread·PermaLink Re: Style KenThompson 3:13 13 Nov '08   I found your response to my last comment more informative/clear/concise than your actual article. My friend, when you post an article on Code Project you are inviting people's feedback. The feedback is what makes the experience here so rewarding! Perhaps you should just encrypt the content of this article so no one makes the mistake of reading it. In addition, you should put "Comments/Feedback not welcome" in clear text so there is no doubt as to your ultimate purpose here. YOU have a nice day - I'm no longer welcoming feedback on how MY day should be! (See how absurd that sounds, come on, lets be adults here.) Sign In·View Thread·PermaLink Re: Style aljodav 9:43 13 Nov '08   KenThompson wrote: I found your response to my last comment more informative/clear/concise... Really? Thank you, very much! KenThompson wrote: ...than your actual article. Are you a univoter? KenThompson wrote: ..."Comments/Feedback not welcome"... You're wrong. Feedbacks about the article/code are welcome; but not about personal feelings; also no strong (or weak) recommendations... KenThompson wrote: Perhaps you should... You're wrong again. What I do and what I don't do is not your business. KenThompson wrote: My friend,... Once more you're wrong. Do not call me your friend. I'm not your friend! KenThompson wrote: YOU have a nice day... You're right. My days (also nights) are always nice, very nice. KenThompson wrote: ...I'm no longer welcoming feedback on how MY day should be!... OK! Have a nice night, Sir. • Sign In·View Thread·PermaLink Re: Style Bernard Gressing 17:21 14 Nov '08   look this aljodav guy is obviously "FAAAAAALAAAAAAAAMING" (spirit fingers/whilest doing the hustle) - stho let him be riiiiiiiiiiiibaaaaaaa riiiiiibaaaaaa andaley andaley meoow.... Sign In·View Thread·PermaLink

Last Visit: 21:02 8 Nov '09     Last Update: 21:02 8 Nov '09 1