What is the best way to encrypt a text file in C/C++?

Question

A C/C++ based cgi web application will be creating a temporary text file on the server as long as the user is logged in. The text file will be deleted when the user logs off. I want to encrypt this text file and also the content of the file. The file will contain information like username and password.

What is the best way to do this?

EDIT: I see libraries being suggested. My problem is I cannot use anything but Standard C++ library.

Solution 1

Use a well known library such as openssl and follow well known examples and stay away from platform specific solutions.

Solution 2

I think you might be going about this the wrong way. If security, real security, is the goal then you're not going to want to store the password even in its encrypted form (because it can be decrypted if the key is stolen, as other people have said).

What you should do is store a hash of the password (with an appropriate salt). This means that no one (not even the site admins) can determine a user's password. They can merely accept a password and see if it's the right one or not by hashing the input with the same salt (you can't reverse a hash).

Also, this sort of situation lends itself nicely to databases, are you using one?

Google password hashing with salts and you can read about it from real security experts (I am not one).

Solution 3

An encryption standard that currently is considered as "safe" is AES (also called Rijndael). You can find a C++ implementation at Codeproject and in many other places.

Please note, that when using AES or any other symmetric encryption standard, you must store the encryption/decryption key inside your application. If anyone discovers the key, he can decrypt all files that you encrypted with this key.

If your application will run under Windows, you also might use DPAPI to store the encrypted information.

Comments

[Matthew Flaschen]

See also stackoverflow.com/questions/674401/crypto-library-for-c

[Matthew Flaschen]

"Please note, that when using AES or any other symmetric encryption standard, you must store the encryption/decryption key inside your application. If anyone discovers the key, he can decrypt all files that you encrypted with this key." Which is exactly why you /can't/ store the raw key inside the app's executable. The key should be protected by a passphrase or similar.

[Matthew Flaschen]

He's using C++. I don't think a PHP script is relevant.