From: Robert <mannl@...>
Date: 2005-10-05T07:09:02+09:00
Subject: [newbie] Encryption using OpenSSL

Hello!

I'm writing a website with Rails and I want to encrypt the passwords  
that go into the database. However, I don't want to use hashes (e.g.  
SHA1). Instead, I want to be able to decrypt to passwords again.

I searched Google and found this:

require 'openssl'
require 'digest/sha1'
c = OpenSSL::Cipher::Cipher.new("aes-256-cbc")
c.encrypt
# your pass is what is used to encrypt/decrypt
c.key = key = Digest::SHA1.hexdigest("yourpass")
c.iv = iv = c.random_iv <-------------------------- What's IV??
e = c.update("crypt this")
e << c.final
puts "encrypted: #{e}\n"
c = OpenSSL::Cipher::Cipher.new("aes-256-cbc")
c.decrypt
c.key = key
c.iv = iv
d = c.update(e)
d << c.final
puts "decrypted: #{d}\n"

That works. However, what's IV? I queried Google and found that it  
stands for "initialization vector". Can anyone quickly explain to me  
what that is, and most importantly: do I have to use that? Or can I  
just leave it out? I'd prefer to just use a key to encrypt the  
passwords, instead of "two keys"..


I'm grateful for any help,

thanks,
Rob