Encrypt and decrypt a text using a password

Encrypt and decrypt a text using a password

  
Hello

I need to use those actions from Crypto extension.
How can I save the password sent to the action on a secure method, that only one person - not related to the server nor to development - can see it?

Developers wouldn´t see this password
Server people (datacenter) wouldn´t either

Is this possible?

Thank you
Hi Carolina,

Maybe with a SiteProperty and you define  the developer permission who they can't see the SiteProperty definition in the Service Center. I think that's it.

Best Regards.
Hello Carolina,

I think that is hard to acomplish since the developer can always see the call of the action and can debug which value goes in. (Sérgio, thats why a site property also wouldn't work).

Assuming there is one administrator, you could make a seperate eSpace where the decrypting is done. Input is plain text, output the encrypted text. In service center you should be able to set the permission on that eSpace only for the administrator so no other person would be able to download/open it.

If you're really want to be shure, make a separte environment with an application applies the encrypt/decrypt as a webservice (that is secured trough ssl with certificate). Only the person that need to know the pw has acces to that server.

Kind regards,
Evert
Ok. I never was to do this yet and it was my first and quick idea to try :)
Hello Sérgio,

Doesn't matter. With Site properties they are able to change the password that was set in SS, but still debugging would show the 'real' value.

Better to write something then nothing. With other 'views' the discussion is gonne start and the result (mostly) is a good solution :).

Kind regards,
Evert

My scenario:

They want a manager to have a paper with this password in a safe.
Developers and others can´t see it, only use on actions.

Could I save ir on the database - using the built-in Encrypt (not Crypto) - and use it? like the password field on USER_MASTER table?
We can´t see user´s password right? It´s encrypted and can´t be decrypted. Correct?

So this person would type a password on an input field and we would use the value on the database as the password for the encryp/decrypt action.

Will the action use the funny numbers or does it decrypts on the background?

I´ll do some tests and let you know!
Thank you for your help until now... let´s see if we can get a good solution!
:)

Hello Carolina,

In that case you indeed would be able to set a password that only the peron who has inputted know. I though you'll needed the crypto to encrypt something and you needed the password, the password that is used in the encrypt/decrypt function, to be hidden for everyone, which is hard since developer would always see it.

If you want to create an encrypted password that needs to be set by the person that knows the password, you'll indeed use an input box where the password is insert and then you can use the (build-in) encrypt() function to encrypt it. The build-in encrypt function is an OS function (that indeed is also used on the password field in the usertable) and there is no decrypt function for that one (well I think someone at OS will probably have it) so nobody would be able to 'see' the real password.

So once you have saved the password encrypted in the DB somewhere then you can check if someone has insert the correct password by encrypt the inputted password using the encrypt function and check it with the original password that you'll need to retrieve from the DB. In de code you'll only will see the funny number being checked with another funny number :-).

Kind regards,
Evert


Hi Carolina,

Encrypt built-in function is one-way. It can't be decrypted at all.
Like Evert said, they in the database it has the value encypted, so to check if a password matches you just have to encrypt the input and see if matches.

If I remember correctly the Crypto methods use a symetric password. So the password to encrypt is the same as used to decrypt. So a developer would be able to see it.

In your scenario you didn't explain what exactly your encrypt/decrypt needs.

A more move secure scenario (very advanced) where the decrypted data is important would require some customization on your own extension.
For example, you can create an extension that uses asymmetric encryption.
On the server it would have a Public Key stored, and a Manager would have the Private Key. Then when necessary he would have to provide the key to decrypt the data.
:)


It all depends on each case, requirements and effort.


Regards,
João Rosado