Changes between Version 4 and Version 5 of security/electronic_signatures


Ignore:
Timestamp:
Feb 28, 2013, 5:02:55 PM (11 years ago)
Author:
Sam Habiel
Comment:

--

Legend:

Unmodified
Added
Removed
Modified

  • security/electronic_signatures

    v4 v5  
    3434As you can see from this table, both OpenVista and WorldVistA have done badly (it's not known whether the OpenVista version is even legal) while vxVista has done the best.
    3535
    36 == A solution to hashing and encryption on GT.M ==
    37 I wrote this routine to replace XUSHSHP:
     36== A solution to hashing and encryption on GT.M/Unix ==
     37I would have used vxVista's solution; but it only works on Cache (both the hash and encryption). For GT.M on Unix, I used the OS pipes to do the work using the well-respected openssl library. For hashing, I use SHA512 with the user's creation date and DUZ as salt. For encryption, I use AES/Rijndael using 256-bit key in Cipher Block Chaining mode. Corresponding methods can be written for Cache on Unix.
     38
    3839{{{
    3940UJOSHSHP ; VEN/SMH - Encrypt Data a la XUSHSHP ;2013-02-27  9:44 AM
    … …  
    195196 QUIT
    196197}}}
     198
     199In addition, with Lloyd Milligan's permission, I used the extensible framework he has written to use to call different algorithms based on configuration. The Public Entry Point, XUSHSHP, references these as follows:
     200{{{
     201XUSHSHP ;SF/STAFF - HASHING ROUTINE FOR SIG BLOCK IN FILE 200 ;2013-02-26  2:32 PM
     202        ;;8.0;KERNEL;;Jul 10, 1995;Build 2
     203        ;
     204HASH ; PEP: HASH; Fallthrough
     205        D X^UJOXCALL("HASH/DIGEST")
     206        Q
     207EN      ; PEP: Encrypt
     208        D X^UJOXCALL("ENCRYPT STRING")
     209        Q
     210DE      ; PEP: Decrypt
     211        D X^UJOXCALL("DECRYPT STRING")
     212        Q
     213}}}
     214
     215UJOXCALL is:
     216{{{
     217UJOXCALL        ;VEN/SMH - External APIs call wrapper ;2013-02-26  3:38 PM
     218        ;;1.0;JORDAN SPECIFIC MODIFICATIONS
     219        Q
     220X(APINAME)      ; Private Proc; Call API based on files
     221        ; Input: APINAME, by Value. External API Name in file 400000001.1
     222        ; Output: None. Executes API. API determines Input and Output variables
     223        ;
     224        N IEN S IEN=$O(^UJO(400000001.1,"B",APINAME,"")) Q:'IEN  ; IEN of API, DINUMMED in imp specific code file (400000001.3)
     225        I $L($G(^UJO(400000001.3,IEN,1))) X ^(1) QUIT  ; Try Implementation specific first
     226        I $L($G(^UJO(400000001.1,IEN,2))) X ^(2) QUIT  ; Otherwise, use default one
     227        ;
     228        ;
     229        ;
     230RUNTESTS I $L($T(EN^XTMUNIT)) S IO=$P,DIQUIET=1 D DT^DICRW,EN^XTMUNIT($T(+0),1) QUIT
     231TESTAPI ; @TEST - Test calling X(APINAME) with existent and non-existent entries.
     232        N X,X1,X2
     233        D X("UNIT TEST ENTRY")
     234        D CHKEQ^XTMUNIT(X,"HELLO WORLD","API wasn't called")
     235        ;
     236        N STR S STR="HELLO WORLD2"
     237        S X=STR,X1="LKJSDF",X2=23432
     238        D X("ENCRYPT STRING")
     239        D CHKTF^XTMUNIT(X'="HELLO WORLD2","Encrypt failed")
     240        D X("DECRYPT STRING")
     241        D CHKEQ^XTMUNIT(X,"HELLO WORLD2","Encrypt/Decrypt failed")
     242        ;
     243        D X("LKSJDKLFDF") ; Make sure there is no crash
     244        QUIT
     245}}}
     246
     247The extensible framework uses the file UJO SUPPORTED API (400000001.1) to decide what code to execute. Each entry in this file defines an API that can be called externally from the
     248Mumps Database. Entries in UJO IMPLEMENTATION-SPECIFIC API (400000001.3) file are DINUMMED to this file and override the default implementation of the API specified in this
     249file if a DINUMMED entry is present in the other file. 
     250 
     251
     252The relevant entries in the files are:
     253{{{
     254Output from what File: UJO SUPPORTED API//   (4 entries)
     255Select UJO SUPPORTED API NAME: HASH/DIGEST 
     256Another one: ENCRYPT STRING 
     257Another one: DECRYPT STRING 
     258Another one:
     259Standard Captioned Output? Yes//   (Yes)
     260Include COMPUTED fields:  (N/Y/R/B): NO//  - No record number (IEN), no Computed
     261 Fields
     262
     263NAME: HASH/DIGEST                       APPLICATION GROUP: KERNEL
     264  DATE CREATED: FEB 25,2013             RESPONSIBLE PERSON: EHS/SW
     265SUPPORTED VARIABLE: X                   ALWAYS DEFINED: YES
     266  BRIEF DESCRIPTION: String to hash
     267  DEFAULT XECUTE: S X=$$UP^XLFSTR(X)
     268 REMARKS:   
     269 Function provides functionality of a password hash so that the original passwor
     270d cannot be decrypted from the hash.
     271 See http://crackstation.net/hashing-security.htm
     272
     273
     274NAME: ENCRYPT STRING                    APPLICATION GROUP: KERNEL
     275  DATE CREATED: FEB 25,2013             RESPONSIBLE PERSON: EHS/SW
     276SUPPORTED VARIABLE: X                   ALWAYS DEFINED: YES
     277  BRIEF DESCRIPTION: String to be encrypted
     278SUPPORTED VARIABLE: X1                  ALWAYS DEFINED: YES
     279  BRIEF DESCRIPTION: encryption salt/password
     280SUPPORTED VARIABLE: X2                  ALWAYS DEFINED: YES
     281  BRIEF DESCRIPTION: encryption salt/password
     282  DEFAULT XECUTE: Q
     283 REMARKS:   
     284 Encrypts data using a password/salt
     285
     286 The variables X1 and X2 are values to be decided upon by the programmer
     287 calling this utility.
     288
     289
     290NAME: DECRYPT STRING                    APPLICATION GROUP: KERNEL
     291  DATE CREATED: FEB 25,2013             RESPONSIBLE PERSON: EHS/SW
     292SUPPORTED VARIABLE: X                   ALWAYS DEFINED: YES
     293  BRIEF DESCRIPTION: Encrypted string to be decrypted
     294SUPPORTED VARIABLE: X1                  ALWAYS DEFINED: YES
     295  BRIEF DESCRIPTION: Encryption salt/password
     296SUPPORTED VARIABLE: X2                  ALWAYS DEFINED: YES
     297  BRIEF DESCRIPTION: Encryption salt/password
     298  DEFAULT XECUTE: Q
     299 REMARKS:   
     300 Decrypts encrypted text using X1 and X2.
     301 If X1 and X2 are different from what was used to encrypt the string,
     302 the encryption will fail.
     303
     304
     305Select OPTION: INQUIRE TO FILE ENTRIES 
     306
     307
     308
     309Output from what File: UJO SUPPORTED API// UJO,IM,S  UJO IMPLEMENTATION-SPECIFIC
     310 API                                      (3 entries)
     311Select UJO IMPLEMENTATION-SPECIFIC API NAME: HASH/DIGEST 
     312Another one: ENC  RYPT STRING 
     313Another one: DEC  RYPT STRING 
     314Another one:
     315Standard Captioned Output? Yes//   (Yes)
     316Include COMPUTED fields:  (N/Y/R/B): NO//  - No record number (IEN), no Computed
     317 Fields
     318
     319NAME: HASH/DIGEST                       XECUTE: D HASH^UJOSHSHP
     320
     321
     322NAME: ENCRYPT STRING                    XECUTE: D EN^UJOSHSHP
     323
     324
     325NAME: DECRYPT STRING                    XECUTE: D DE^UJOSHSHP
     326}}}
     327