From: khaines@...
Date: 2006-10-29T22:35:26+09:00
Subject: Re: symetrical encryption algo's ?

On Sun, 29 Oct 2006, Francis Cianfrocca wrote:

> I have a feeling I'm missing something, but if all you want to do is
> generate obfuscated URLs, why not just the the SHA1-hash of a string
> consisting of the  "real" url and the user's name? You can store the
> generated urls in the server-side user-session so you don't have to do any
> decrypting.

Maybe the URL he's obfusicating doesn't go to a machine under his control?

I have a requirement for something like this right now.

A web site with private content links to an external provider.  The users 
log into the private content with a standard userid/password 
authentication.

The external provider trusts my authentication, so they want liks to them 
to encode the userid using a symetric algorithm with a specific key.  The 
users just see a url like:

http://foo.com/place?1b12d9542f%2f33b1a4

and feel all warm and fuzzy.  The external provider can recover the userid 
from that, though, and can thus give the user their specific content.

I'm using the http://rubyforge.org/projects/crypt/ library for this.


Kirk Haines