Problem - Kevin Tafuro

Remember to use a MAC anytime you encrypt, even though this
expands your message length. The MAC is almost always necessary
for security! For databases, you can always base64-encode the MAC
output and stick it in another field. (See Recipe 6.9 for how to MAC
data securely.)
Note that encrypt_within_charset( ) can be used for both encryption and decryption.
For clarity’s sake, we alias decrypt_within_charset( ) using a macro.
The previous code works for fixed-size wide characters if you operate on the appropriate
sized values, even though we only operate on single characters. As written,
however, our code isn’t useful for variable-byte character sets. With such data, we
recommend that you accept a solution that involves message expansion, such as
encrypting, then base64-encoding the result.
See Also
Recipes 5.2, 6.9
4.13 Managing Key Material Securely
Problem
You want to minimize the odds of someone getting your raw key material, particularly
if they end up with local access to the machine.
Solution
There are a number of things you can do to reduce these risks:
• Securely erase keys as soon as you have finished using them. Use the spc_
memzero( ) function from Recipe 13.2.
• When you need to store key material, password-protect it, preferably using a
scheme to provide encryption and message integrity so that you can detect it if
the encrypted key file is ever modified. For example, you can use PBKD2 (see
Recipe 4.10) to generate a key from a password and then use that key to encrypt
using a mode that also provides integrity, such as CWC (see Recipe 5.10). For
secret keys in public key cryptosystems, use PEM-encoding, which affords password
protection (see Recipe 7.17).
• Store differentiating information with your medium- or long-term symmetric
keys to make sure you don’t reuse keys. (See Recipe 4.11.)
See Also
Recipes 4.10, 4.11, 5.10, 7.17, 13.2
Managing Key Material Securely | 149
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.