Re: Encrypting passwords

David Lowndes wrote:
>> I have an application where a user enters a password, which is to
>> be used the next time the user wants to invoke the application.
>> The password is to be encrypted before being stored in the
>> registry.
>
> If you only need to target Windows 2000 and later operating systems,
> you could use the DPAPI facilities which are really easy to use -
> http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnsecure/html/windataprotection-dpapi.asp

If you need to target NT you can use
LsaStorePrivateData/LsaRetrievePrivateData also documented in MSDN.

>> I would just need simple XOR encryption/ decryption.

In that case why won't you just store the password in clear text? Assuming
you are going to use a fixed key, a XOR-ed password stored in the registry
can be broken in about 2 minutes.


--
Eugene
http://www.gershnik.com


.

Relevant Pages