I recently implemented an authentication system, supported by a table on the database. In this table, I store the usernames and passwords.
The PostgreSQL “pgcrypto” module supports encryption of specific columns, but I wanted to avoid “bulking” my system with more add-ons; also, I was not sure about trusting the administrator of the database. For all these reasons, I decided to go for client-side encryption.
As I am using the QT API, my first guess was to look for encryption related functionality on this framework.
Since Qt 4.3., there is a class called QCryptographicHash, that provides a way to generate cryptographic hashes, from binary or text data. It supports a couple of “popular” message-digest algorithms such as MD5, MD4 or SHA1. This is interesting, but not usable in my case since “hashing” is a “one-way process”: you can create an hash from data, but not “decrypt” it back to the original value.
For the purpose of encrypting and decrypting data, there is the QCA library, which is based on SSL and therefore uses asymmetric cryptography. I had a quick look at this library and it looks pretty powerful; however, I was in a “quest” to avoid installing libraries, so I decided to look for another alternative. I also have to add that I am not in need to achieve “bullet proof” encryption, but solely to keep my data hidden from “curious eyes of users”, that don’t know much about programming or cryptography. *If you want strong data encryption, then QCA is the way to go*.
Finally I stumbled upon SimpleCrypt (Simple Encryption), a class developed by a Qt user to protect against “casual observation”: just what I was looking for.
SimpleCrypt provides symmetric encryption (the same key is used for encode and decoding the data). This key is a 32 bits quint64, built into the program, on the SimpleCrypt class.
SimpleCrypt crypto(Q_UINT64_C(5ebed0982db747741f47)); //some random number
It can be used to encode strings, as well as streams of binary data. More details about the encryption algorithm can be found here.
In my application, I use a QDataWidgetMapper, to map different widgets such as line boxes, to fields in the database. In the case of the “password” field, the mapping won’t work since the user will type and see a password that is different from the cyphertext stored in the database table. To prevent this, I need a “proxy” between the database and widget; this proxy is the QItemDelegate.
By reimplementing this class and apply it to my widgets, I can “force” the application to transform the values that it writes/reads in the database, by applying the encrypting algorithm.
This would be my the implementation for the item delegate:
#include "passwddelegate.h"
#include "simplecrypt.h"
SimpleCrypt crypto(Q_UINT64_C(5ebed0982db747741f47)); //some random number
PasswdDelegate::PasswdDelegate(QList<int> colsOthers, QList<int> colsText, QList<int> colsPass,QObject *parent):
NullRelationalDelegate(colsOthers,colsText,parent), m_colsPass(colsPass)
{
}
void PasswdDelegate::setModelData(QWidget *editor, QAbstractItemModel *model, const QModelIndex &index) const
{
if (m_colsOthers.contains(index.column()) || m_colsText.contains(index.column()) ){
NullRelationalDelegate::setModelData(editor,model,index);
}else if (m_colsPass.contains(index.column())){
model->setData(index, crypto.encryptToString(editor->property("text").toString()));
}
else QSqlRelationalDelegate::setModelData(editor,model,index);
}
void PasswdDelegate::setEditorData(QWidget *editor, const QModelIndex &index) const
{
if (m_colsOthers.contains(index.column()) || m_colsText.contains(index.column())){
NullRelationalDelegate::setEditorData(editor,index);
}else if (m_colsPass.contains(index.column())){
editor->setProperty("text", crypto.decryptToString(index.data().toString()));
}
else QSqlRelationalDelegate::setEditorData(editor,index);
}
The method “setModelData” is called each time that we want to write values in the encrypted field, and it transforms the plain text password into a cyphertext, by applying the compiled key. The method “setEditorData” on the other hand, transforms the cyphertext in the database into plain-text, by applying the same key.
This is how the pasword looks to the user:
And this is what is actually stored on the database:
SimpleCrypt provides a simple method for “cyphering” user passwords in the database; it is not “unbreakable” but it is one extra level of security, and it is pretty easy to use, not requiring the installation of any extra libraries (you may download simplecrypt.h and cimplecrypt.cpp from here). The QItemDelegate is a class that allows us to control what the user “sees”, while still benefiting from the advantages of using a QDataWidgetMapper. In this case, it works as a charm.
heartcode 