encrypting and decrypting with perl

[Marshall Dudley]

I have an application where I need to encrypt a bit of text, and then I
need to be able to decrypt it using a customer's key. I want to make
sure that the key to decrypt is NOT on the server anywhere, so hackers
cannot get the decrypt key, which means I cannot use a symetrical key
pair since the encryption key will need to be on the server.

What I need is more like a public key cypher. But I want the customer
to be able to create his own private unencrypt key (like a password),
and then the server generates the public encrypt key from that. I do
not want the customer to have to enter a 128 or 1028 byte sequence each
time he executes the program, but to be able to enter a password he can
remember or have written down.

This is what I want.

1. When customer signs up, he enters a password. The password is NOT
stored on the system, but is used to generate a nonsymetrical encryption
key, which is stored on the server.
2. Sensitive information is encrypted using the encryption key.
3. When the customer wants to see the sensitive information, he has to
log in, using the password he supplied in #1, and this is the decryption
key for the information. This password is never stored on the server,
but only passed from session to session with an ssl connection.

Are there any libraries that allow a nonsymetrical key pair, where the
encryption key can be generated from the decryption key that the
customer supplies?

Thanks,

Marshall

 

[Brian McCauley]

I have an application where I need to encrypt a bit of text, and then I
need to be able to decrypt it using a customer's key. I want to make
sure that the key to decrypt is NOT on the server anywhere, so hackers
cannot get the decrypt key, which means I cannot use a symetrical key
pair since the encryption key will need to be on the server.

So the obvious choice would be PGP. There's a module on CPAN with
"Crypt" and "PGP" in the name that may help.

What I need is more like a public key cypher. But I want the customer
to be able to create his own private unencrypt key (like a password),
and then the server generates the public encrypt key from that. I do
not want the customer to have to enter a 128 or 1028 byte sequence each
time he executes the program, but to be able to enter a password he can
remember or have written down.

Sounds very like the way PGP operates to me.

This is what I want.

1. When customer signs up, he enters a password. The password is NOT
stored on the system, but is used to generate a nonsymetrical encryption
key, which is stored on the server.
2. Sensitive information is encrypted using the encryption key.
3. When the customer wants to see the sensitive information, he has to
log in, using the password he supplied in #1, and this is the decryption
key for the information. This password is never stored on the server,
but only passed from session to session with an ssl connection.

There should be no problem doing that with PGP. Of course the password
may get stored in your swap-file.

Are there any libraries that allow a nonsymetrical key pair, where the
encryption key can be generated from the decryption key that the
customer supplies?

Forget libraries, I'm not aware of any PK _algorithm_ that would allow
that. All the PK algorithms I know create a key _pair_ in a single
operation and it is just about as hard to go from the private key to the
public as the other way.

However there is no need in anything you've said you want to achieve to
generate the encryption from the decryption key. Simply store the
encryption key (which is public after all) in step 1.

This, of course, has nothing to do with Perl.