We have an application that fetches data from
our partner's through Windows Web Services.
We deliver an ACL 8.0 executable and are using
the libraries provided with Allegro to do the
Web Services code.
For every query that we post we append a username
and password, which reside in the Windows Registry.
For instance, a snippet of code looks like this:
(multiple-value-bind (body code)
(handler-case
(net.aserve.client::do-http-request ws-path
:method :post
:query (append query-list
(get-ws-username-and-password)))
...)
Obviously, having the password in plaintext is not very
secure, and we would like to remedy this situation.
Allegro provides functions for accessing Registry values
as illustrated in the following function:
(defun get-web-services-server ()
"Relies on the Windows registry to return the server address (url)."
(ole:registry-value ole:rkey-local-machine
"WebService"
'("WWWWW" "XXX" "YYYY" "ZZ")))
So basically, we'd like to code get-ws-username-and-password
like get-web-services-server, but the username and password
values would be encrypted in the Registry (from the scripts
that install the server and client software) and decrypted by
the function.
The partner that we are working with uses such a scheme in
their own Web based code, which is mostly VB.NET. In
.NET framework, classes are provided to encrypt/decrypt
registry entries.
Does anyone have experience/ideas on how to solve this
encryption/decryption problem?
Thanks,
Larry
From: Edi Weitz
Subject: Re: Encrypt/Decrypt Windows Registry Values
Date:
Message-ID: <usl521ku6.fsf@agharta.de>
On Tue, 25 Sep 2007 16:37:46 -0400, Laurence Kramer <·······@cs.cmu.edu> wrote:
> In .NET framework, classes are provided to encrypt/decrypt registry
> entries.
>
> Does anyone have experience/ideas on how to solve this
> encryption/decryption problem?
If all else fails, you could try to call the corresponding .NET
methods through RDNZL:
http://weitz.de/rdnzl/
Edi.
--
Lisp is not dead, it just smells funny.
Real email: (replace (subseq ·········@agharta.de" 5) "edi")
Edi Weitz wrote:
> On Tue, 25 Sep 2007 16:37:46 -0400, Laurence Kramer <·······@cs.cmu.edu> wrote:
>
>> In .NET framework, classes are provided to encrypt/decrypt registry
>> entries.
>>
>> Does anyone have experience/ideas on how to solve this
>> encryption/decryption problem?
>
> If all else fails, you could try to call the corresponding .NET
> methods through RDNZL:
>
> http://weitz.de/rdnzl/
>
> Edi.
>
I'm not waiting for "all else to fail." After a browse through
your page, it looks like RDNZL may be exactly what I need.
I'll try it out!
Thanks,
Larry
(message (Hello 'Laurence)
(you :wrote :on '(Tue, 25 Sep 2007 16:37:46 -0400))
(
LK> The partner that we are working with uses such a scheme in
LK> their own Web based code, which is mostly VB.NET. In
LK> .NET framework, classes are provided to encrypt/decrypt
LK> registry entries.
how encrypting/decrypting registry entries is different to
encrypting/decrypting any other data?
get it from registry in the encrypted form, and then decrypt..
you can find crypt/decrypt functions in the ironclad CL library, for
example.
LK> Does anyone have experience/ideas on how to solve this
LK> encryption/decryption problem?
i dunno about what is "encryption for registry", but often Microsoft
products use Protected Storage APIs for handling data like passwords.
however, it's quite complex to access it even in C++..
)
(With-best-regards '(Alex Mizrahi) :aka 'killer_storm)
"Hanging In The Balance Of Deceit And Blasphemy")
Alex Mizrahi wrote:
> (message (Hello 'Laurence)
> (you :wrote :on '(Tue, 25 Sep 2007 16:37:46 -0400))
> (
>
> LK> The partner that we are working with uses such a scheme in
> LK> their own Web based code, which is mostly VB.NET. In
> LK> .NET framework, classes are provided to encrypt/decrypt
> LK> registry entries.
>
> how encrypting/decrypting registry entries is different to
> encrypting/decrypting any other data?
It's not.
> get it from registry in the encrypted form, and then decrypt..
>
> you can find crypt/decrypt functions in the ironclad CL library, for
> example.
>
> LK> Does anyone have experience/ideas on how to solve this
> LK> encryption/decryption problem?
>
> i dunno about what is "encryption for registry", but often Microsoft
> products use Protected Storage APIs for handling data like passwords.
> however, it's quite complex to access it even in C++..
Our business partner controls the software install/configuration
side of things, and they work in the .NET world, so it's probably
best that we work with that if possible. I'll take a look at
the ironclad tools, though. Thanks for the pointer.
Larry