Hey all, I am looking for a way to encode and then encrypt a payload that will later be passed to a webhook in the web app. We’re talking something like “put these two options in your config/config.exs and then call these two functions”. What’s a very quick and low-friction way to encrypt a binar…

Why not just generate a random string, store it in the database and send that ? (or a hash like @derek-zhou said.) So even if someone sniffs it, it is meaningless. Is there a fundamental problem to send a value that is also stored in the database, it the value is just a one-time key for fetching?

Hi! I see two scenarios (sorry if I’m misreading your post): You do not care about the encoded information being read but just want to make sure it was not tempered with. In this case signing might be sufficient and you can use Phoenix.Token — Phoenix v1.8.8 or similar which is low-friciton if you…

I was hoping for something without an external dependency. Basically a way to call :crypto which is a bit confusing to me. BTW I want the data secret. I assume encrypting it well also prevents tampering. But if I can’t do that I’ll definitely use Cloak.

Well you can certainly choose to use :crypto directly but you’ll have to take care of IVs and padding yourself. We ended up doing something like this (note that this has a hardcoded IV size of 16): defmodule CryptoOneTime do require Logger def encrypt_binary(data) when is_binary(data) do …

The best way to keep something secret is not to transmit it, encrypted or not. I would put said payload in a database, get the sequence id and just send the id with hashids This way you send a very short string regardless how large is the payload.

That’s what I want to do. Everything is in the DB, I just want the ID sent back securely. How secure is hashids though?

That looks good. I assume I’ll have to store the IV in config/config.exs and not only the secret key?

The IV is computed for every encrypt so that encrypting the same payload twice yields different results (similar idea as a salt). It’s prepended to the encrypted payload, so that it can be read and used for decryption. So you only need to keep the secret key in your config.exs (or runtime.exs more l…

Thank you. Let me try it and I’ll comment back! I just keep forgetting those encryption primitives, hence my question here. :smiley:

I see. But this seems to become a homegrown cryptography solution, which is something I want to avoid.

Elixir Programming Language Forum

One-off encryption?

Questions & Help Questions

derek-zhou October 22, 2021, 8:17pm 10

Hashid is not very secure. to add extra protection on tempering, you can append a sha3 hash.