Field encryption how-to

[nolamike]

Hi Forum, 

 

So I am trying to figure out how I might encrypt some fields in Filemaker, using Scriptmaster. Here's where I am at:

 

 - Want to have the interface as follows:  user sees encrypted text in the field by default, clicks a "Reveal text" button, is prompted for a password, and if the correct one is entered, sees the unencrypted text in a dialog. 

 - I could just use EncryptDES() and DecryptDES() and be done with it, but I understand AES is stronger, so I'd like to use Encrypt/DecryptAES() if possible. 

- So I need a 128-bit key to work with AES. But I don't want the user to have to memorize/deal with that—rather, just with a conventional password. So, I am thinking of having the conventional password get hashed with a random salt using Cryptography - MD5 Hash() (1000X iteration to be secure), producing the 128-bit key. 

- So I need to store something in the database to check against the entered password. Normally with password verification systems, the hash is stored. But the hash is the secret AES key! So I don't want to store that. 

- If I don't store it, how can my script tell if the correct password has been entered? I guess I can just run the decryption with whatever is entered, and if the users sees junk in the output, they know they entered the incorrect password. But it seems there must be a more elegant way to do this.

Edited May 4, 2015 by nolamike

[nolamike]

OK, I think I have figured out a solution. In addition to creating the 128-bit key (for AES) using MD5 with a salted password, I can use the same password with a different salt to store a verification hash. Then when a password is entered, I can hash it with the 2nd salt and compare to the verification hash.  A match, and the script can take the password, along with the 1st salt, create the decryption key for AES, decrypt, then discard the key. 

Anyone see a hole in this plan?

[Wim Decorte]

As long as all pieces of that puzzle are stored in FM it is not really going to be secure...

Also you have to absolutely keep perfect track of when what field is encrypted or decrypted.  And make that approach safe against FM crashes / network interruptions.  So think "transactional model".  Otherwise you risk decrypting when it is already decrypted or encrypting when it is already encrypting, and in the process toast your data.

[Kris M]

And of course if someone enters the right password, exposes the encrypted data and walks away from the machine when the sensitive data is exposed then anyone can see it password or not.

<< reminded of this in a previous Wim thread

[nolamike]

@wim re: storing the puzzle pieces. True, but if I store only the 2 salts and verification hash at least some serious time and effort (I think) is involved in breaking in.  re: crashes. I do have to think through protecting against interruptions.  Seems the riskiest model is getting text out of a field, en/decrypting, then writing back to the same field. I should at least dedicate a field to storing the encrypted text and nothing else. 

@kris good point. Thinking now I will have the decrypted text display in a field, then have it disappear after a short time interval. 

[jsubiros]

Hello,

I am trying to use encryptDES in scriptmaster plugin, but I need to do it all (password, text and result) in hexadecimal. 

Is it possible ??

Thanks.

[Wim Decorte]

Why not use the native functions?

 

https://fmhelp.filemaker.com/help/18/fmp/en/index.html#page/FMP_Help%2Fcryptencrypt.html%23ww1281314

and

https://fmhelp.filemaker.com/help/18/fmp/en/index.html#page/FMP_Help%2Fhexencode.html%23

[jsubiros]

because my customer need it DES encrypt. 

 

[Wim Decorte]

Really??  DES is insecure and has been withdrawn as a NIST standard back in the early 2000s, when it was replaced by AES.

There have been proven attacks on DES.

[jsubiros]

I know it. But customer wants like that. I cannot change his mind.
That's why it's not easy to find DES encrypt.

[john renfrew]

https://lmgtfy.com/?q=encrypt+with+des+java

 

 

[jsubiros]

I need for FileMaker, I don't know if this can put in scriptmaster. I thing scriptmaster use groovy, not java, but similar.

I don't know how to do it. Thanks anyway.

[Wim Decorte]

If you want to do this without a plugin then leverage FM's native support for JavaScript and use a JS library like Google's CryptoJS

https://cryptojs.gitbook.io/docs/