
July 24th, 2012, 01:42 AM
|
|
Registered User
|
|
Join Date: Jul 2012
Posts: 3
Time spent in forums: 48 m 4 sec
Reputation Power: 0
|
|
|
The application is using external program for encrypting database connection string.
The program that is used for encryption takes two strings. First one is connection string and second is encryption key. Output of this program are two encrypted files. I guess that first one contains encrypted connection string, and second one contains encrypted encryption key. Any copy of the application can decrypt this files. I guess that decryption key for this files is hard-coded in the application.
I am concerned about security of this approach because if I am right, both encrypted data and encryption key are available to the potential attacker and they are encrypted with hard-coded key.
The data in the application is not very confidential, but I am willing to refuse it if I find it insecure to save me from future headaches.
Below are hexdumps for both encrypted data string and encrypted encryption key.
Source for both of them is "qwertyuiop1234567890"
Data:
0000000 a19c 5555 de82 c198 a682 1501 93c5 9ed8
0000010 eeda 1709 a7f6 aced
0000018
Key:
0000000 854e 90a8 0a26 d2ce 3eaf f0d6 1ac1 80f1
0000010
|