> I'm trying to write a password manager and I think I will be able to get an > effective keylength > 64 bit, thus making it more or less
Do you know keyring for Palm? It's hosted on Sourceorge I think. That gave me a start on using the AESLib and is maybe what you want to do. > secure against non-supercomputer (or grid) attacks. In general the > danger of compromising the key is basically larger when there's > malicious code on the device that logs key input and/or scans the > memory. So it would be nice to know, how many known apps are in > the wild that do stuff like this and that could be used to break > an otherwise secure database. > In the past I had to break in into some databases and programs, legally. For example, finding passwords to port data from one application to another where the software developer firm was gone with the wind, or migrating from one app to another where the developers were unwilling to help. Hackers have loads of helper tools to do such stuff, most of them you won't see in the wild so it could only be guessed how many such tools exist. It's almost never a grid computer or brute force attack, it's common to use the code functions inside the application for your own needs. It doesn't help to have a 1024 bit encryption key if the key is stored somewhere encrypted in the application and you could simply misuse the applications decrypt function to get the plaintext db password for an example. I'm not at all a specialist in this field, but I'd say the real threat like industry espionage comes from direct attacks and not viruses from the wild. If I was a bad guy I would send you a serious looking advertisement application that's interesting for your business and install a changed application which overwrites a original version on your PC or Palm which you trust in the background. I've no idea about keyloggers on Palm. In general hackers use often the simulators/emulators (runing the app from card so that they can analyse it with software on PC while it's running on the Palm) and PC tools to break into Palm applications. There are plenty of tutorials on hacker sites where they boast about their newest hacks. Could be a good point to take care of common tricks. Code obfuscation and a password to encryption key hashing is a good thing to start with. But the real bad guys have a lot of Wodka and Martini and too much time ;-) Regards Benjamin Stadin -- For information on using the PalmSource Developer Forums, or to unsubscribe, please see http://www.palmos.com/dev/support/forums/
