full-disclosure - Hardcoded Keys

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4d413ee20809030231y43db8a44s4045876b1e91d57e@mail.gmail.com>
Date: Wed, 3 Sep 2008 16:31:25 +0700
From: "Samuel Beckett" <beckett.samuel@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Hardcoded Keys

What would be the the worst case if you implement the following scenario for
a credit card transaction:

- Store the private keys as disk files and place them in an area on a server
that is readable from a DLL that contains the decryption algorithm
-Hardcode one password into a DLL and the other password will be supplied by
the service that requests the decryption. This password is then SHA1 hashed
with a passphrase -- the result is used to decrypt the private key.

After the successful credit card transaction, certain credit card details
are then encrypted and stored within the database.

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/