CVI encryption support

[menchar]

Does CVI offer anything that supports encrypting, say, a password for use with the password control fp?

I'd like to save the password to the registry but have it encrypted so that anyone looking at the value wouldn't be able to use it.

I understand that it's possible to assign permissions to registry values, but then I have to come up with a logon group that allows access/set permisssions and I'd like to avoid that whole hassle.    Just a simple encryption so that I have the decrypt key hardcoded into the application and I don't have to hassle who's logged on as who that's running the application.  I don't want to just hardcode the password since I'd like to be able to change it using the application itself.

Menchar

[Ian.W]

Good question! 

I have similar needs and was tinkering with a simple XOR encryption - doing a bitwise XOR on a fixed length string while taking care of the trailing NULLs.  I have attached my non-robust experiment in case it gives you some ideas. But no guarantees at all!!

--Ian

[Mohan]

I am not aware of any encryption/decryption functions in CVI libraries. If you are on Windows, you can use the Win32 Cryptographic functions CryptHashMessage, CryptVerifyMessageHash or CryptVerifyDetachedMessageHash (see http://msdn2.microsoft.com/en-us/library/aa380203.aspx) to hash passwords. You probably need the SDK or VC libraries for this.

If you are not averse to depending on .NET, there are easier to use functions in the System.Security.Cryptography namespace of the mscorlib assembly (see http://msdn2.microsoft.com/en-us/library/system.security.cryptography.aspx), especially check the MD5 or SHA1 CryptoServerProvider classes. CVI wrappers for mscorlib are present in the samples/dotnet folder.

If you want something much simpler, you may want to just XOR the bytes - this results in something apparently encrypted but is of course very easy to crack. Also, I am sure there is a lot of simple encryption code for C on the web.

[Mert_A.]

Just an additional note. I don't believe there's any real difference between encryption and hashing.  For your purposes, it is probably effective just to find a decent hash function out there in the public domain and use it to hash the password.  You don't really need to "unhash" the password; you can just hash the user's input and see if it matches the stored password hash.

I would suggest Bob Jenkins' lookup3 hash function.  Though I make no guarantees, it is purportedly a good general purpose hash function (it is linked from Wikipedia's Hash Function entry).

Mert A.
National Instruments

[menchar]

Thanks to all for the good ideas.

Menchar

[Kurt Jakobsen]

I have an .Net (aspx) application that I want to share password with a CVI application (store hashed pwd in registry then typing the pwd in either .Net or CVI should give the same hashed pwd that can be compared with the one in registry).

But I have not been able to find hash functions that give the same hashed string in CVI and .Net.

I found an CVI example posted on http://decibel.ni.com/content/docs/DOC-1157

Apparently it uses MD5, but it does not give the same hashed string as .net give with the function pasted below. Both the .Net and CVI functions have some parameters to play around with, but I do not know how to set them to provide the same output.

Is there anybody who have managed to compute the same hashed string from .net and CVI (does not need to be MD5,  anything that will provide a secure password checking will do)

using System.Security.Cryptography;

static public string GetCryptString(string str)

{ 

Encoder enc = System.Text.Encoding.Unicode.GetEncoder();  byte[] unicodeText = new byte[str.Length * 2];

enc.GetBytes(str.ToCharArray(), 0, str.Length, unicodeText, 0, true);

MD5 md5 = new MD5CryptoServiceProvider();

byte[] result = md5.ComputeHash(unicodeText);

 StringBuilder sb = new StringBuilder(); for (int i=0;i<result.Length;i++)

{

sb.Append(result[i].ToString("X2"));

}

string sRet = sb.ToString();

} 

[Mohan]

The problem might be because you are using unicode. CVI does not support unicode. Try using the ASCII encoding in .NET and in general only allow ASCII characters in the string to be encrypted. Also, check the byte[] you sent to the encoding function - it may have '\0' bytes in between characters and also at the end of the buffer - and if so, this would also be encoded in .NET but not in C.

[Kurt Jakobsen]

Thanks Mohan,

I changed the ' 

'Encoder enc = System.Text.Encoding.Unicode.GetEncoder();'

line in the .Net program to

'Encoder enc = System.Text.Encoding.ASCII.GetEncoder();'

and still did not get the same hashed output with equal input. Here are the input's and output's:

.Net:

Input: Test

Output: 1E6647F8ED6D050D0642E96AD800E9F8

CVI:

Input: Test

Output: 3047692a864886f7d175a03a303821030c682a864886f7d25503013692a864886f7d171a064454657374410cbc6611f554bd0809a388dc95a615b

As far as I can see both the input's are free of '\0' bytes. 

I've had a look at the CryptHashMessage function description in 'http://msdn.microsoft.com/en-us/library/aa380203(VS.85).aspx' but did not catch exacly how I can play with parameters and what it will do with the output.

It is not important for me which hashing functions to use in either of the IDE's nor which parameters to use as long as I can produce similar output with identical input in CVI and .Net.

Anybody, please let me know if you know a solution that can do that, or if you see what will make my codes play on the same team.

[Mohan]

Both the MD5 hashes you are getting are wrong. Here are the correct ways to do it. These give the same and correct MD5 hash in both .NET and CVI.

[C#]

static string Encrypt(string input)

{

   char[] inputChars = input.ToCharArray();

   System.Text.Encoder encoder = System.Text.Encoding.ASCII.GetEncoder();

   byte[] inputBytes = new byte [encoder.GetByteCount(inputChars, 0, inputChars.Length, true)];

   encoder.GetBytes(inputChars, 0, inputChars.Length, inputBytes, 0, true);

   System.Security.Cryptography.MD5CryptoServiceProvider hasher =

      new System.Security.Cryptography.MD5CryptoServiceProvider();

   byte[] outputBytes = hasher.ComputeHash(inputBytes);

   StringBuilder builder = new StringBuilder();

   foreach (byte b in outputBytes)

     builder.Append(b.ToString("x2"));

   return builder.ToString();

}

[CVI]

static char *Encrypt(const char *input)
{
 unsigned char *output;
 char *result;
 int outputLen, i;
 System_Security_Cryptography_MD5CryptoServiceProvider hasher;
 
 System_Security_Cryptography_MD5CryptoServiceProvider__Create(&hasher, NULL);
 System_Security_Cryptography_MD5CryptoServiceProvider_ComputeHash_1(hasher,
  (unsigned char *) input, strlen(input), &output, &outputLen, NULL);
 CDotNetDiscardHandle(hasher);
 result = malloc(2 * outputLen + 1);
 result[0] = '\0';
 for (i = 0; i < outputLen; ++i)
 {
  char buf[3];
  sprintf(buf, "%02x", output[i]);
  strcat(result, buf);
 }
 return result;
}

void main(void)
{
 char *result;
 
 Initialize_mscorlib();
 result = Encrypt("Test");
 puts(result);
 free(result);
 Close_mscorlib();
 getchar();
}

[Kurt Jakobsen]

Thanks Mohan,

this looks promising. The only obstacle I have now is that I am not able to compile the CVI project. I get Undecleared identifier for 'System_Security_Cryptography_MD5CryptoServiceProvider'. I tried to google around as well as searching the NI and SDK help without being able to find what it needs. Here are the includes that are used (and I've pasted your suggested code in the project without changing anything):

#include <windows.h>
#include <cvidotnet.h>
#include <formatio.h>
#include <utility.h>
#include <ansi_c.h>
#include <wincrypt.h>
#include <cvirte.h>  
#include <userint.h>
#include "hashing.h"

And the Crypt32.lib is added to the project.

Any idea what's missing?