Re: Encryption packages

[Scott Klement <klemscot@xxxxxxxxxxxx>]

Hi Howard,

Reading your message, a few things popped into my head:

What exactly are you going to do with the encrypted data?

   a) does an external system need to be able receive your encrypted data
        and decrypt it?
   b) will an external system be sending you encrypted data that you need
        to decrypt?

The reason that I ask is that OS/400 has objects that can be used to
store usernames & passwords in an encrypted format, where all the
encryption work is hidden from your program.  This works great if you
just need a list of userids/passwords that are valid for a certain
resource, but not so well if you need to transfer it over a LAN and
decrypt it somewhere else.

If you do need to transfer it, the AS/400 has an MI instruction called
"CIPHER" which is capable of doing DES encryption.  DES was a great
encryption back in it's day, but by todays standards is pretty weak.
Still, if the security of it isn't REALLY CRITICAL, then this might be
a good option.


On Fri, 11 Jan 2002, Weatherly, Howard wrote:
>
> I was just asked is we have any encryption packages for the 400, I know
> think this is available as a feature but I can not find the book or pages
> that I read this in.
>
> Anyone know where I can hunt this information up? and so I can give the
> choices, I posted on the COBOL list for any home grown code, but I could
> also use some input on any packages anyone might have used.
>
> My understanding is that security wants us to encrypt UID/PWD that we have
> in a external client user verification system, so basically the thing does
> not need to be heavy duty. I am going to surf about and cook up a list of
> possibilities that I can match with any possible Kudos and/or horror
> stories.
>