Changes between Version 3 and Version 4 of security/electronic_signatures

Timestamp:

Feb 28, 2013, 4:46:06 PM (11 years ago)

Author:

Sam Habiel

Comment:

--

security/electronic_signatures

@@ -32 +32 @@
 ||Encryption/Decryption||None||Restore VA Routine||Blowfish symmetric block cipher
 
-As you can see from this table, both OpenVista and WorldVistA have done badly (it's not known whether the OpenVista version is even legal) while vxVista has done the best. 
+As you can see from this table, both OpenVista and WorldVistA have done badly (it's not known whether the OpenVista version is even legal) while vxVista has done the best.
+
+== A solution to hashing and encryption on GT.M ==
+I wrote this routine to replace XUSHSHP:
+{{{
+UJOSHSHP ; VEN/SMH - Encrypt Data a la XUSHSHP ;2013-02-27  9:44 AM
+ ;;1.0;JORDAN SPECIFIC MODIFICATIONS;
+ ;
+HASH ; HASH
+ Q:'$D(X)  Q:'$L(X)
+ ; Input: X from Symbol Table. X can be any length
+ ; Output: X hashed, as 20 characters
+ ;
+ ; Use sha512 with user stuff as salt
+ ; Should use PBKDF2, bcrypt, or scrypt; but not available in openssl CLI.
+ S X=$$UP^XLFSTR(X) ; Uppercase X; per original VA code.
+ N SALTED S SALTED=$P(^VA(200,DUZ,1),U,7)_X_DUZ ; Salt X with User Creation Date and DUZ.
+ N CALL S CALL="openssl dgst -sha512" ; SHA512 OS call
+ N DEVICE S DEVICE="hashPipe"
+ N OUTPUT
+ N OLDIO S OLDIO=$IO
+ OPEN DEVICE:(shell="/bin/sh":comm=CALL)::"PIPE"
+ USE DEVICE WRITE SALTED,/EOF READ OUTPUT:1 U OLDIO CLOSE DEVICE
+ S X=$E(OUTPUT,$L(OUTPUT)-19,$L(OUTPUT)) ; X is the return variable; only 20 characters long
+ QUIT
+ ;
+EN ; ENCRYPT
+ Q:'$D(X)!('$D(X1))!('$D(X2))  Q:'$L(X)
+ ; Expect X, X1, X2
+ ; X is the string to encrypt. X1 and X2 are salts/password
+ ; X1 can be the DUZ
+ ; X2 can be the checksum of the text to encrypt
+ ; Output: X, the encrypted string. Length is the same the input.
+ ; Maximum supported length is maximum global node length.
+ ; Encrypting word processing fields is not supported.
+ ;
+ ; AES- Cipher Block Chaining with Base 64 encoding with password w no salt.
+ N CALL S CALL="openssl enc -a -aes-256-cbc -nosalt -pass pass:"_X1_X2
+ ; N CALL S CALL="openssl enc -a -des-ede3-cbc -nosalt -pass pass:"_X1_X2
+ ; N CALL S CALL="openssl enc -bf-cbc -nosalt -pass pass:"_X1_X2
+ ; N CALL S CALL="openssl enc -a -rc4 -nosalt -pass pass:"_X1_X2
+ N DEVICE S DEVICE="encryptionPipe"
+ N OLDIO S OLDIO=$IO
+ OPEN DEVICE:(shell="/bin/sh":comm=CALL)::"PIPE"
+ USE DEVICE
+ WRITE X,/EOF ; Write the string to encrypt
+ N I,OUTPUT ; I = counter. OUTPUT = encyrpted tems
+ FOR I=1:1 READ OUTPUT(I) Q:$ZEOF  ; Read it into Output Array
+ U OLDIO
+ CLOSE DEVICE
+ ; Next two lines: concatentate the array into the root node
+ S OUTPUT="" 
+ F I=1:1 Q:'$D(OUTPUT(I))  S OUTPUT=OUTPUT_OUTPUT(I) K OUTPUT(I)
+ ; X is the output from the API
+ S X=OUTPUT
+ QUIT
+ ;
+DE ; DECRYPT
+ Q:'$D(X)!('$D(X1))!('$D(X2))  Q:'$L(X)
+ ; Expect X, X1, X2
+ ; X is the string to encrypt. X1 and X2 are salts/password
+ ; X1 can be the DUZ
+ ; X2 can be the checksum of the text to encrypt
+ ; Output: X, the decrypted string. Length is the same the input.
+ ; Maximum supported length is maximum global node length.
+ ; Encrypting word processing fields is not supported.
+ N CALL S CALL="openssl enc -d -a -aes-256-cbc -nosalt -pass pass:"_X1_X2
+ ; N CALL S CALL="openssl enc -a -d -rc4 -nosalt -pass pass:"_X1_X2
+ N DEVICE S DEVICE="decryptionPipe"
+ N OLDIO S OLDIO=$IO
+ OPEN DEVICE:(shell="/bin/sh":comm=CALL)::"PIPE"
+ USE DEVICE
+ F  W $E(X,1,64),! S X=$E(X,65,1024*1024*1024) Q:X=""  ; Write Input base64 style
+ WRITE /EOF
+ N OUTPUT R OUTPUT:1 ; Read Output of decryption back.
+ U OLDIO
+ CLOSE DEVICE
+ S X=OUTPUT ; X is output
+ QUIT
+ ;
+RUNTESTS S IO=$P S DIQUIET=1 D DT^DICRW D:$L($T(EN^XTMUNIT)) EN^XTMUNIT($T(+0),1) QUIT
+THASH ; @TEST - Test Hashing
+ N DUZ
+ S DUZ=1 N X S X="HELLO WORLD" D HASH
+ N RESULT1 S RESULT1=X
+ S DUZ=1 N X S X="HELLO WORLD" D HASH
+ N RESULT2 S RESULT2=X
+ D CHKEQ^XTMUNIT(RESULT1,RESULT2,"Hash results are not equal")
+ ;
+ S DUZ=1 N X S X="HELLO WORLD" D HASH
+ N RESULT1 S RESULT1=X
+ S DUZ=2 N X S X="HELLO WORLD" D HASH
+ N RESULT2 S RESULT2=X
+ D CHKTF^XTMUNIT(RESULT1'=RESULT2,"Hash results are not supposed to be equal")
+ ;
+ S DUZ=1
+ N X S X="Hello World" D HASH
+ N RESULT1 S RESULT1=X
+ N X S X="HELLO WORLD" D HASH
+ N RESULT2 S RESULT2=X
+ D CHKEQ^XTMUNIT(RESULT1,RESULT2,"Hash results of different cases aren't equal")
+ QUIT
+ ;
+THASH2 ; @TEST - Test Hashing using main calling routine XUSHSHP
+ N DUZ
+ S DUZ=1 N X S X="HELLO WORLD" D HASH^XUSHSHP
+ N RESULT1 S RESULT1=X
+ S DUZ=1 N X S X="HELLO WORLD" D HASH^XUSHSHP
+ N RESULT2 S RESULT2=X
+ D CHKEQ^XTMUNIT(RESULT1,RESULT2,"Hash results are not equal")
+ ;
+ S DUZ=1 N X S X="HELLO WORLD" D HASH^XUSHSHP
+ N RESULT1 S RESULT1=X
+ S DUZ=2 N X S X="HELLO WORLD" D HASH^XUSHSHP
+ N RESULT2 S RESULT2=X
+ D CHKTF^XTMUNIT(RESULT1'=RESULT2,"Hash results are not supposed to be equal")
+ ;
+ S DUZ=1
+ N X S X="Hello World" D HASH^XUSHSHP
+ N RESULT1 S RESULT1=X
+ N X S X="HELLO WORLD" D HASH^XUSHSHP
+ N RESULT2 S RESULT2=X
+ D CHKEQ^XTMUNIT(RESULT1,RESULT2,"Hash results of different cases aren't equal")
+ QUIT
+ ;
+TENC ; @TEST - Test Encryption
+ N VALUE S VALUE="Mary has a little lamb"
+ S X=VALUE,X1=1,X2=234234234
+ D EN,DE ; encrypt, decrypt X
+ D CHKEQ^XTMUNIT(VALUE,X,"Encryption and decryption didn't happen properly")
+ ;
+ N VALUE2 S VALUE2="Mary has a little lamb"
+ S X=VALUE2,X1=88,X2=234234234
+ D EN ; encrypt
+ N ENCSTR1 S ENCSTR1=X
+ S X=VALUE2,X1=1,X2=234234234 ; Different X1
+ D EN ; encrypt
+ N ENCSTR2 S ENCSTR2=X
+ D CHKTF^XTMUNIT(ENCSTR1'=ENCSTR2,"Encrypted strings with different passwords are not supposed to be equal")
+ QUIT
+ ;
+TENC2 ; @TEST - Test Encryption by calling XUSHSHP
+ N VALUE S VALUE="Mary has a little lamb"
+ S X=VALUE,X1=1,X2=234234234
+ D EN^XUSHSHP,DE^XUSHSHP ; encrypt, decrypt X
+ D CHKEQ^XTMUNIT(VALUE,X,"Encryption and decryption didn't happen properly")
+ ;
+ N VALUE2 S VALUE2="Mary has a little lamb"
+ S X=VALUE2,X1=88,X2=234234234
+ D EN^XUSHSHP ; encrypt
+ N ENCSTR1 S ENCSTR1=X
+ S X=VALUE2,X1=1,X2=234234234 ; Different X1
+ D EN^XUSHSHP ; encrypt
+ N ENCSTR2 S ENCSTR2=X
+ D CHKTF^XTMUNIT(ENCSTR1'=ENCSTR2,"Encrypted strings with different passwords are not supposed to be equal")
+ QUIT
+LENGTH ; @TEST - Test Lengths
+ N X,X1,X2,I
+ S (X1,X2)=982734987234
+ W !
+ F I=1:1:60 K X S $P(X,"A",I)="A" W $L(X) D EN W ?30,$L(X),!
+ QUIT
+}}}