ESAPI Encryption - Revision history

Kevin W. Wall: Added several possible enhancements.

2011-08-21T05:33:36Z

Added several possible enhancements.

2008-12-11T19:55:54Z

‎Possible Enhancements

2008-12-11T14:43:17Z

‎Feature Overview

2008-12-11T14:43:17Z

‎Possible Enhancements

2008-12-11T14:39:23Z

2008-12-11T13:41:02Z

New page: == Feature Overview == TODO == Possible Enhancements == * TODO * ...

New page

== Feature Overview ==

TODO

== Possible Enhancements ==

* TODO

* ...

@@ Line 5: / Line 5: @@
 == Possible Enhancements ==
 * Potentially rename Seal and Unseal to better describe what they do
-* seal() should include an HMAC or integrity check to ensure that the encrypted data has not been tampered with (see [http://cwe.mitre.org/data/definitions/649.html CWE-649]).
+* seal() should include an HMAC or integrity check to ensure that the encrypted data has not been tampered with (see [http://cwe.mitre.org/data/definitions/649.html CWE-649]). (NOTE: By default, ESAPI crypto already ensures message authenticity and seal() uses that, so this likely would be redundant. -Kevin W. Wall)
 * The API should include support for key rotation; indicated key used for encryption of data
@@ Line 12: / Line 12: @@
 * The documentation for each method should indicate whether it is designed to protect integrity, confidentiality, or both; and whether it is suitable for encrypting transient items (such as hidden form fields) or is designed for long-term storage.

@@ Line 1: / Line 1: @@
 == Feature Overview ==
-The Encryptor API is designed to provide a simplified API for common operations developers may want to use in web applications.  It is not designed to be a general-purpose crypto API, but only to provide safe implementations of common functionality.
+TODO
 == Possible Enhancements ==
-* seal() should include an HMAC or integrity check to ensure that the encrypted data has not been tampered with.
+* The API should include support for key rotation; indicated key used for encryption of data
 * The API should allow key management to be externalized, to allow developers to integrate their own key management strategies (such as a PKI).
 * The documentation for each method should indicate whether it is designed to protect integrity, confidentiality, or both; and whether it is suitable for encrypting transient items (such as hidden form fields) or is designed for long-term storage.

@@ Line 1: / Line 1: @@
 == Feature Overview ==
-TODO
+The Encryptor API is designed to provide a simplified API for common operations developers may want to use in web applications.  It is not designed to be a general-purpose crypto API, but only to provide safe implementations of common functionality.
 == Possible Enhancements ==
-* Potentially rename Seal and Unseal to better describe what they do
 * seal() should include an HMAC or integrity check to ensure that the encrypted data has not been tampered with.
-* The API should include support for key rotation; indicated key used for encryption of data
+* The API should include support for key rotation
 * The API should allow key management to be externalized, to allow developers to integrate their own key management strategies (such as a PKI).
 * The documentation for each method should indicate whether it is designed to protect integrity, confidentiality, or both; and whether it is suitable for encrypting transient items (such as hidden form fields) or is designed for long-term storage.

@@ Line 4: / Line 4: @@
 == Possible Enhancements ==
+* Potentially rename Seal and Unseal to better describe what they do
 * seal() should include an HMAC or integrity check to ensure that the encrypted data has not been tampered with.
-* The API should include support for key rotation
+* The API should include support for key rotation; indicated key used for encryption of data
 * The API should allow key management to be externalized, to allow developers to integrate their own key management strategies (such as a PKI).
 * The documentation for each method should indicate whether it is designed to protect integrity, confidentiality, or both; and whether it is suitable for encrypting transient items (such as hidden form fields) or is designed for long-term storage.

@@ Line 5: / Line 5: @@
 == Possible Enhancements ==
-* TODO
+* seal() should include an HMAC or integrity check to ensure that the encrypted data has not been tampered with.
-* ...
+* The API should include support for key rotation