Using the ColdFusion encrypt() function

Pinal,

Thank you for your reply.
That site lists a general overview of how the algorithm works. For example, it lists:

"Encrypt function uses an XOR-based algorithm that utilizes a pseudo random 32-bit key based on a seed passed by the user as a parameter to the function"

I need to know HOW that key is generated based on the seed. I need to know what SPECIFICALLY the XOR based algorithm is.

To rephrase, I want to implement the decrypt funtion in Visual Basic, I need details.

~Amethyst

why not use another encrypt function? One build outside CF, or build your own with an algorythm you know, so you can also build it in another language. It doesn't look like MM will publish the algorythm out in the open..

Hi amethyst3739,
blockSize = 64;

for (i = 0; i < blokSize-1; i++)
dataBlock[i]^=(key[i+1]^dataBlock[i+1]);

After that the same operation is generated to the left:

for (i = blokSize-1; i > 0; i--)
dataBlock[i]^=(key[i-1]^dataBlock[i-1])

For more info: http://www.miraxus.com/chaos.htm

Regards,
---Pinal

Hi amethyst3739,
http://browsex.com/XOR.html

Regards,
---Pinal

Hello,

TacoBell777, I would use another algorithm (In fact that was the first thing I tried). It worked great, but the problem was speed. I am encrypting ~5,000 rows of data, DES and AES took about 32 minutes(no joke) to run. The only thing that seemed to work reasonably fast was the built in Xor routine. The problem is that I can't quite decrypt it.

Pinaldave, Thank you for the links. I am aware of the weaknesses of Xor used with small keys. Unfortunately it's all I have at the moment, and chaos is simply not fast enough.

So I'm still trying to decrypt the Coldfusion encrypt() function given that I have the key seed. Still trying to do this in VB. Still trying to do it quickly. I am upping the point value of this question given its complexity.

Regards,
Amethyst

Oops,

My appologies, I didn't realize it was already worth 500.

The problem is that what you are asking them to divulge is proprietary information.

Additionally the more information that is publicy announced about how an encryption is done makes it that much easier to hack and crack.

So if your concern is speed then you should take what they have divulged as a clue that your own encryption should be written using an XOR algorithhm and play with them until you find one that meets your needs.

I don't think you will find the answer you are looking for here - nor anywhere else unless you have an inside contact at macromedia that is willing to break a confidentiality agreement.

Mrichmon,

Yes, I understand that Macromedia's encrypt() function is proprietary. However, XOR encryption is widely used. I had (wrongly) assumed that Macromedia had used a standard implementation of a pRNG seed based key, or had published it in a white paper. I guess that is not the case, which seems odd to me given that they've used straight-up MD5 for their hash() function.

I disagree with the idea that publishing an encryption scheme makes it less secure. The security of encryption lies in its mathematical strength, not in its algorithmic obscurity. It's the difference between keeping your money in an incredibly strong bank vault or hiding it in a shoebox under the bed. Ultimately, any algorithm can be reverse engineered (I don't want to do that), and then your only relying on the math behind it.

Before I digress to much, I want to point out that I'm still open to the idea of encrypting the file another way, but how?

I have experience in encryption, but not much in ColdFusion. The results of my query are presented in a record set, which I convert into a string. The reason the algorithms I've tried are so slow is because I can not figure out how to perform bitwise operations on this string.

If I want to speed up the whole thing, I think I'll need to convert the string to a byte array before I do anything to it. How can I do this in ColdFusion?

Thank you all, as always, for yout help

Amethyst

amethyst3739,

You said you tried another algorithm, which took 32 minutes. Did you build that in ColdFusion? If so, try again in e.g. Java and use that in your CF templates. String handling in ColdFusion is very very slow and should be avoided when using large strings or complex string handling.

Mosphat,

You are correct in assuming that I tried to build it in ColdFusion. I am sure that that is why it ran so slowly. I like your idea, but how would I accomplish this? I know Java and Javascript, but I am unsure as to how I can execute the code server side using ColdFusion. The server's running 5.0.

Sounds like you need a CFX.  If you have the algorithm you like and it is slow in CF, I can do it for you in C.  CFX for CF (will work in all versions of CF) and DLL and/or EXE for client's decryption.  No points. Some $$ will be enough.