It depends on your security requirements really.

If you want some hardcore security i'd consider something like a public key system, or something like a revolving token (ala secure_id from RSA).

If you want to protect your data from a casual browser, then a simple ROT13 scheme may be ok, but given the availability of cypher modules on CPAN and how easy they are to use, you've got a choice of a very wide range of very good cyphers. There is no point implementing a deliberately insecure "cypher" ala ROT13 IMO when all these others are available.

So, back to the original question, how to manage your keys. Well I guess it depends on the level of complexity you wish to maintain.

Key management in the most secure sense is difficult to get right, and some may say, it just cant be done. the difficulty comes with key distro, how can you ensure the key has not been intercepted? you cant, (unless you use the "in the research phase" quantum method (ie, the very act of viewing the key changes the stream making the indication the key has been previously viewed)).

So, in a this case, you're data may not be that important, and so you may very well choose to use the same key for all crypts. Not very secure as once the key is compromised, then all your data is vulnerable.

Take it a step up and use a public key system, and keep the private key "somewhere safe" public key systems are typically harder to brut force than a symetric key system (such as DES, 3DES, blowfish, twofish etc etc).

One key for all? or different keys? if you choose a one key method, how are you going to manage the keys? a file? something offline? your biological memory? how automated does the solution need to be? It sounds to me like the solution may need full automation, and given the nature of the data (email addresses) it could be easier to use a single key.

If you keep your keys in a secure location (ie appropriate permissions on a file, it probably doesnt really matter if you use may keys or a single key, if you're automating it, its not going to be too much extra effort to manage multiple keys.

We havent even touched on other aspects of security, such as circumventing the cypher entirely by sniffing the network traffic, rubber hose cryptanalysis (probably not so appropriate in this situation), and other attack methods...

So, bottom line, as always, is it depends. It doesnt make life easier, but you should know your rquirements completely depend on your individual sutation.

In reply to Re: Safe symmetric encryption - Crypt::CBC + Crypt::Blowfish? by Ryszard
in thread Safe symmetric encryption - Crypt::CBC + Crypt::Blowfish? by diotalevi

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.