lihao has asked for the wisdom of the Perl Monks concerning the following question:

Dear Perl monks:

Can you give me some suggestions on Perl modules which support (en|de)cipher a given input string that I can use with data delivered in cookies or in the query strings of the request URIs?? I am now using Crypt::CBC as mentioned in chapter-5 of Writing Apache Modules with Perl and C. I am not sure if there are some nice or better alterative that I can use. Sometimes I feel that the encrypted strings with Crypt::CBC are really too long to show in the URIs.

Thank you so much for your information.. :-)

Have a good day,

H

  • Comment on need suggestions on Perl modules to support Encrypt Data

Replies are listed 'Best First'.
Re: need suggestions on Perl modules to support Encrypt Data
by moritz (Cardinal) on Oct 28, 2007 at 21:09 UTC
    Crypt::CBC obviously provides block cyphers, which means that the length is (usually? always?) extended to the block length.

    So maybe you want a stream cypher, but I couldn't find one on CPAN.

    But usually you shouldn't transport encrypted data in URLs - what are you trying to achieve? Chances are there is a better solution to your problem.

[reply]

      Hi, moritz:

      Thank you for your replies.. there are some examples that I used encrypted string on the URI: one is the CAPTCHA strings that send to GD::SecurityImage to dynamically generate images and do the autntication from the sender.. I canot get another idea to handle this, so I send the encrypted string on the URIs... Another implementation is when something like directory names shown up in the URI, i.e. "http://example.com/ask.html?D=/path/to/a/diretory" , I want to flatten them(not for high security info, I can use pack|unpack with 'H*', but want to add some light ciphered info, BTW these URLs are not frequently visited links)

      Can you recommend some methods or modules which can solve these problems nicer. many thanks :-)

      H.

[reply]
        For the captchas: store the string and a session ID in a database, and only send the session ID to the user.

        You could use that scheme for the paths as well, or if you want some light weight encryption, check out RC4. That's very easy to implement, but sadly not very secure. But secure enough to keep the occasional script kid off.

[reply]

Back to Seekers of Perl Wisdom