|By Wayne Graham||
|September 15, 2004 12:00 AM EDT||
How secure are your applications? Public-Key encryption may be the solution when security really matters.
If you have developed an application that requires user authentication, you have undoubtedly wrestled with varying levels of security. At a basic level, most security models revolve around membership, authentication, and authorization functions. Secure socket layers (SSL) is a popular method for securing the transmission of data between Web server and client. ColdFusion MX and ColdFusion 6.1 have very good integration with Java's Secure Socket Extensions Library, which is capable of 2048-bit encryption. While the transmission of the data over the Internet via SSL helps secure against electronic eavesdropping, the data stored in your applications may still be at risk.
The storage of passwords is a prime example of this security risk. If your database is compromised in some way, the attacker has access to all user accounts and passwords. As a result, programmers have developed various techniques for addressing this issue. ColdFusion itself has an encryption function available - encrypt() - that utilizes an XOR (exclusive OR) algorithm to generate a pseudo 32-bit symmetric key. Another method involves using ColdFusion's hash() function. The hash() function is based on an MD5 (message digest version 5) 128-bit hash algorithm that converts strings into 32-bit hexadecimal "fingerprint" or "message digest" representations of the original string. A stronger variant of this method involves introducing salt - a random string of some length - and concatenating it with the password before performing the hash function.
While storing an encrypted or hashed version of passwords using ColdFusion's built-in functions is a good practice, these methodologies fall a bit short when security is a real issue. The hash() function is a one-way encryption algorithm that can be decrypted only by brute force. MD5 hashing as a method of securing passwords and other data falls apart when one does a Google search of "MD5 crack." For unsalted hashes, the time needed to crack a single MD5 hash online is about 40 minutes (http://passcracking.com). Depending on your personal computer speeds, this can be done faster with a tool like md5crack (www.checksum.org/download/MD5Crack). In fact, in 1994 Paul van Oorschot and Mike Wiener showed that a brute force attack on a 128-bit hash function requires 264 (2.1019) evaluations to crack; at the time such a crack would take less than a month with a $10 million investment in hardware.
To deal with the shortcomings of 128-bit hash functions, stronger encryption algorithms have been invented. Today's 160-bit encryption algorithms such as SHA1 (secure hash algorithm, www.w3.org/PICS/DSig/SHA1_1_0.html) and RipeMD160 (www.esat.kuleuven.ac.be/~bosselae/ripemd160.html) increase the time required for a brute force attack. For areas where a 160-bit hash is still not strong enough, SHA also comes in 256-bit, 384-bit, and 512-bit data lengths for added security in one-way encryption.
Because hash() is a one-way encryption algorithm, it is most appropriate when text does not need to be read (as in the case of passwords). By contrast, the encrypt() function utilizes symmetric-key cryptography, meaning that both the sender and receiver of the string share a common key used to encrypt and decrypt the string. Thus, the private key must at some point be transferred in some secure way, and is only effective if the symmetric key is kept secret.
In ColdFusion, this transfer is done on the server in memory when a page with the encrypt() function is requested, which keeps the transmission of the passphrase reasonably secure. Yet, in the case of encrypt(),the key is actually passed in both the encrypt() and decrypt() functions as plain text:
password = "Th1s !s A [email protected] str0nG pA5Sw0rD!";
symmetricKey = "pa$sPhrAs3 f0r 3ncRypt1ng p4s$w0rDs";
encrypted = encrypt(password, symmetricKey);
decrypted = decrypt(encrypted, symmetricKey);
<p>#encrypted# <br/> #decrypted#</p>
Depending on who has access to your code, this could be a recipe for disaster.
When you need to be able to encrypt and decrypt, additional steps must be taken. ColdFusion's encrypt() function can be decrypted, but the key must be passed in the code on the server, causing a security issue (plus encrypted data placed on the Web can be fairly easily cracked using any number of free tools available on the Internet.
An alternative to ColdFusion's private-key encryption method is public-key encryption. Public-key encryption - or asymmetric encryption - requires two keys - one private and one public. Data encrypted with your public key can be decrypted only with your private key, allowing you to freely distribute your public key in a non-secure manner (i.e., as clear text posted on a Web page). Asymmetric encryption uses longer algorithms for calculating file fingerprints than symmetric encryption algorithms, and is effective for generating significantly obfuscated data. As a brief side note, these algorithms are processor intensive, so using public key encryption may not be appropriate for very large files.
Unfortunately, in order to take advantage of asymmetric encryption in ColdFusion, you must look beyond built-in ColdFusion tools. The two big players in the realm of public-key cryptography are Pretty Good Privacy (PGP; www.pgp.com) and GNU Privacy Guard (GnuPG; www.gnupg.org). "GnuPG is a complete and free replacement for PGP," and since GnuPG does not depend on the patented International Data Encryption Algorithm (IDEA), there are no restrictions on its use, nor are there any licensing fees for integrating GnuPG into your applications. This last fact makes it an attractive candidate for developers, and is used in the examples for this article. Along with the strong two-way encryption algorithms (1024-bit DSA and ElGamal), GnuPG also supports stronger hashing functions (SHA1, RIPEMD160, and SHA256) for your one-way encryption needs.
|Thomas Gorgolione 07/23/08 05:05:27 PM EDT|
You have to compile the code manually from the zip file (see post #5). I did that already, so if you want you can just download it here:
|Jeff 01/31/08 08:07:47 AM EST|
Does anyone have the GnuPG.jar file? I found the CF component but that still needs the GnuPG.jar file to operate and the link in the article to get GnuPG.jar does not work.
|Shaun 09/04/07 02:21:25 PM EDT|
|William Broadhead 07/21/05 03:00:51 PM EDT|
Good story. Very informative. One thing I would note is that in cf using the encrypt/decrypt: You don't have to, and shouldn't include the actual key in your code, NOR in your Database... A tecnnique I use is to store the key in a text file on the server in a directory that is accessible to coldfusion but NOT part of the http accessible directory. Using cffile you can read and load the information in the file to memory as an application key to use for hashing passwords while never having the key in your code nor in your database. Although obviously, as the article points out, security can never be completely infallible, this can reduce the capacity of your data to be compromised if you did somehow lose a copy of your database or page code, you would need also need to lose the file for someone to put it all together...
|Mark 07/14/05 01:53:05 PM EDT|
Great article, very well written.
|Brad 03/28/05 10:13:32 AM EST|
Great Article, convinced my peers to use this instead of upgrading to CF7Mx.
As for the gentleman looking for the source, click the Source Code link located under Related Sites. Scroll down... you're welcome.
|Nguyen Tran 03/21/05 10:50:00 AM EST|
Where to download the file? GnuPG.jar
On this page, there is no link to download the file GnuPG.jar
Please give us the link to download the file GnuPG.jar
|Tom 02/08/05 06:05:04 AM EST|
i´ve the same problem: where is gnupg.jar?
|Shane 12/16/04 11:14:17 AM EST|
nevermind.... I found it.
|Shane 12/16/04 11:09:21 AM EST|
Great article. I've been looking forward to trying this out but haven't been able to find the gnupg.jar file. Am I overlooking it somewhere? Please advise.
Internet of @ThingsExpo, taking place November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 19th Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The Internet of Things (IoT) is the most profound change in personal and enterprise IT since the creation of the Worldwide Web more than 20 years ago. All major researchers estimate there will be tens of billions devices - comp...
Sep. 29, 2016 12:45 PM EDT Reads: 5,128
The many IoT deployments around the world are busy integrating smart devices and sensors into their enterprise IT infrastructures. Yet all of this technology – and there are an amazing number of choices – is of no use without the software to gather, communicate, and analyze the new data flows. Without software, there is no IT. In this power panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, panelists will look at the protocols that communicate data and the emerging data analy...
Sep. 29, 2016 12:30 PM EDT Reads: 1,743
“We're a global managed hosting provider. Our core customer set is a U.S.-based customer that is looking to go global,” explained Adam Rogers, Managing Director at ANEXIA, in this SYS-CON.tv interview at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York City, NY.
Sep. 29, 2016 12:00 PM EDT Reads: 3,132
According to Forrester Research, every business will become either a digital predator or digital prey by 2020. To avoid demise, organizations must rapidly create new sources of value in their end-to-end customer experiences. True digital predators also must break down information and process silos and extend digital transformation initiatives to empower employees with the digital resources needed to win, serve, and retain customers.
Sep. 29, 2016 12:00 PM EDT Reads: 413
Smart Cities are here to stay, but for their promise to be delivered, the data they produce must not be put in new siloes. In his session at @ThingsExpo, Mathias Herberts, Co-founder and CTO of Cityzen Data, will deep dive into best practices that will ensure a successful smart city journey.
Sep. 29, 2016 11:45 AM EDT Reads: 2,580
Why do your mobile transformations need to happen today? Mobile is the strategy that enterprise transformation centers on to drive customer engagement. In his general session at @ThingsExpo, Roger Woods, Director, Mobile Product & Strategy – Adobe Marketing Cloud, covered key IoT and mobile trends that are forcing mobile transformation, key components of a solid mobile strategy and explored how brands are effectively driving mobile change throughout the enterprise.
Sep. 29, 2016 11:30 AM EDT Reads: 2,143
DevOps at Cloud Expo, taking place Nov 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 19th Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to wait for long dev...
Sep. 29, 2016 11:00 AM EDT Reads: 3,510
Cloud computing is being adopted in one form or another by 94% of enterprises today. Tens of billions of new devices are being connected to The Internet of Things. And Big Data is driving this bus. An exponential increase is expected in the amount of information being processed, managed, analyzed, and acted upon by enterprise IT. This amazing is not part of some distant future - it is happening today. One report shows a 650% increase in enterprise data by 2020. Other estimates are even higher....
Sep. 29, 2016 11:00 AM EDT Reads: 4,164
The Jevons Paradox suggests that when technological advances increase efficiency of a resource, it results in an overall increase in consumption. Writing on the increased use of coal as a result of technological improvements, 19th-century economist William Stanley Jevons found that these improvements led to the development of new ways to utilize coal. In his session at 19th Cloud Expo, Mark Thiele, Chief Strategy Officer for Apcera, will compare the Jevons Paradox to modern-day enterprise IT, e...
Sep. 29, 2016 11:00 AM EDT Reads: 2,402
What happens when the different parts of a vehicle become smarter than the vehicle itself? As we move toward the era of smart everything, hundreds of entities in a vehicle that communicate with each other, the vehicle and external systems create a need for identity orchestration so that all entities work as a conglomerate. Much like an orchestra without a conductor, without the ability to secure, control, and connect the link between a vehicle’s head unit, devices, and systems and to manage the ...
Sep. 29, 2016 11:00 AM EDT Reads: 297
In this strange new world where more and more power is drawn from business technology, companies are effectively straddling two paths on the road to innovation and transformation into digital enterprises. The first path is the heritage trail – with “legacy” technology forming the background. Here, extant technologies are transformed by core IT teams to provide more API-driven approaches. Legacy systems can restrict companies that are transitioning into digital enterprises. To truly become a lea...
Sep. 29, 2016 11:00 AM EDT Reads: 394
What are the new priorities for the connected business? First: businesses need to think differently about the types of connections they will need to make – these span well beyond the traditional app to app into more modern forms of integration including SaaS integrations, mobile integrations, APIs, device integration and Big Data integration. It’s important these are unified together vs. doing them all piecemeal. Second, these types of connections need to be simple to design, adapt and configure...
Sep. 29, 2016 10:45 AM EDT Reads: 450
Information technology is an industry that has always experienced change, and the dramatic change sweeping across the industry today could not be truthfully described as the first time we've seen such widespread change impacting customer investments. However, the rate of the change, and the potential outcomes from today's digital transformation has the distinct potential to separate the industry into two camps: Organizations that see the change coming, embrace it, and successful leverage it; and...
Sep. 29, 2016 10:30 AM EDT Reads: 1,243
19th Cloud Expo, taking place November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy. Meanwhile, 94% of enterpri...
Sep. 29, 2016 10:30 AM EDT Reads: 4,443
SYS-CON Events announced today that CDS Global Cloud, an Infrastructure as a Service provider, will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. CDS Global Cloud is an IaaS (Infrastructure as a Service) provider specializing in solutions for e-commerce, internet gaming, online education and other internet applications. With a growing number of data centers and network points around the world, ...
Sep. 29, 2016 10:30 AM EDT Reads: 2,980
In his general session at 18th Cloud Expo, Lee Atchison, Principal Cloud Architect and Advocate at New Relic, discussed cloud as a ‘better data center’ and how it adds new capacity (faster) and improves application availability (redundancy). The cloud is a ‘Dynamic Tool for Dynamic Apps’ and resource allocation is an integral part of your application architecture, so use only the resources you need and allocate /de-allocate resources on the fly.
Sep. 29, 2016 10:30 AM EDT Reads: 2,897
Major trends and emerging technologies – from virtual reality and IoT, to Big Data and algorithms – are helping organizations innovate in the digital era. However, to create real business value, IT must think beyond the ‘what’ of digital transformation to the ‘how’ to harness emerging trends, innovation and disruption. Architecture is the key that underpins and ties all these efforts together. In the digital age, it’s important to invest in architecture, extend the enterprise footprint to the cl...
Sep. 29, 2016 10:15 AM EDT Reads: 615
There are several IoTs: the Industrial Internet, Consumer Wearables, Wearables and Healthcare, Supply Chains, and the movement toward Smart Grids, Cities, Regions, and Nations. There are competing communications standards every step of the way, a bewildering array of sensors and devices, and an entire world of competing data analytics platforms. To some this appears to be chaos. In this power panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, Bradley Holt, Developer Advocate a...
Sep. 29, 2016 10:15 AM EDT Reads: 2,386
SYS-CON Events announced today that LeaseWeb USA, a cloud Infrastructure-as-a-Service (IaaS) provider, will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. LeaseWeb is one of the world's largest hosting brands. The company helps customers define, develop and deploy IT infrastructure tailored to their exact business needs, by combining various kinds cloud solutions.
Sep. 29, 2016 10:15 AM EDT Reads: 3,300
A strange thing is happening along the way to the Internet of Things, namely far too many devices to work with and manage. It has become clear that we'll need much higher efficiency user experiences that can allow us to more easily and scalably work with the thousands of devices that will soon be in each of our lives. Enter the conversational interface revolution, combining bots we can literally talk with, gesture to, and even direct with our thoughts, with embedded artificial intelligence, wh...
Sep. 29, 2016 10:00 AM EDT Reads: 3,909