Never Use the encrypt function !

Question

Never Use the encrypt function !

rvanderpal

SSC Journeyman

Points: 96
More actions
December 19, 2002 at 11:46 pm

#79205

Try this:
select encrypt('test')
Result:
0x7400650073007400
huh?
0x
74 select char(0x74) = t
00
65 select char(0x65) = e
00
73 etc
00
74
00
So far for the simplest undocumented encryption alg.
Therefore use: pwdencryption
Regards,

Viewing 5 posts - 1 through 4 (of 4 total)

You must be logged in to reply to this topic. Login to reply

Antares686 SSC Guru Points: 125444 More actions · Answer 1

Yes it is not a good encryption, and this is a major reason why it is not documented. They don't really want you to use it.

rvanderpal SSC Journeyman Points: 96 More actions · Answer 2

By the way the odbc encryption method works similar:

select {encrypt N'hallo'}

compare the result to :

select {encrypt N'<abcd...z>'

and there is your list for decoding

enough on this i'll bet everyone knew it already...

merry christmas

quote:
Yes it is not a good encryption, and this is a major reason why it is not documented. They don't really want you to use it.

Scorpion_66 SSCertifiable Points: 7891 More actions · Answer 3

Even though some of us were aware, It's always great to see. In my case, I haven't though of it in years that I can remember. It's not something that's thought about generally in the normal course of business, and as Antares686 mentioned, its not documented, so your not likely to see it in research unless it's what your researching. Kudo's for throwing it out there, in my opinion, and just think about how many people who didn't know it, now have the opportunity to see it in an active forum.

K. Brian Kelley SSC Guru Points: 114642 More actions · Answer 4

This should go without saying but...

Rely on the algorithms that have been tested by the crypto community and found thus far to be strong... ones where if the attacker knows the ciphertext and the algorithm, it's still too costly to try and break by using brute force. There are enough of them out there that your choices are broad.

If the algorithm isn't published, don't assume it's secure. Chances are it's not published because the algorithm ISN'T secure.

K. Brian Kelley

http://www.truthsolutions.com/

Author: Start to Finish Guide to SQL Server Performance Monitoring

http://www.netimpress.com/shop/product.asp?ProductID=NI-SQL1

K. Brian Kelley
@kbriankelley