How to securely store Encryption keys in Salesforce? - encryption

We have a package that needs to use an encryption key to encrypt/decrypt data in an object. The current thought is to store this key in a protected custom setting within Salesforce. Are there other options exist for storing keys securely?
Is there a commercial grade cert issued by a Cert. Authority that can be easily moved between various Orgs?

I believe a protected custom seeing within your managed package would work best since it would only be assigned from within your managed package or a protected custom metadata types are another option that you should look into.

Related

ASP.Net Core 2(.1.2) - Save user data without having to trust the client

I'm currently working with ASP.Net Core 2.1.2 and I can't find a solution for my problem.
Currently I'm building a controlpanel together with Angular 5.
The data for a user is stored in a MySQL database.
To have access to the controlpanel you have to login - and the server will load some data. Important is the admin-level (1-?) - some actions are only allowed for admins with atleast a level.
For the authentication I'm using JWTBearer, which gets sent by the client at every HTTP action as header. But in some methods I also want to check the admin-level.
Now where can I store data for the client, like his admin-level?
Is it safe to save it with a Claim? But then wouldn't it be possible for the client to modify it clientside and send a "custom" header?
I also tried to put the data in a dictionary and use the (HttpContext.)User (of type ClaimsPrinciple) as the key, but that won't work because User is always different at every Request.
Is there any safe way to store the data for a User?
You can safely store your admin-level information in a Claim, unless you're worried that someone can read it. It's not possible to modify a Claim in JWT, because its value is signed by key which only you should know and after the modification this token will be invalid. Read this article to get more information about JWT

Encryption strategy for access to more than one account

In my app I give users the ability to store data and share it with specific other users. We are going to add a layer of security by encrypting the data stored and using a users specific public key to decrypt and view the data. What is the best way to enable those other users with access to decrypt and view the data? Use the public key to get a shared cipher perhaps? I'm not sure on how to approach this :S
Well, using a user-specific key is not the correct way to go if you want to share some but not all files. Instead, you'd want a file-specific key.
In turn, you encrypt this file key with the public key of the owner. If the owner wants to share the file, he decrypts the file key with his private key and re-encrypts it with the public key of the person he wants to share the file with.
This means you use symmetric key cryptography for the files, and asymmetric key cryptography for the key management.

Custom .NET Membership

I use .net membership but everything what i work i want to be custom.
What i want to do is:
Create custom data table [Users] with custom fields
Import current data into new table
Create custom classes and functions about everything what i need for [Users]
I`m not sure how .net membership works, but maybe it send encrypted cookie then when i use
var user = Membership.GetUser();
.Net decrypt user cookie and know which user is.
Here is a screenshot how .net create user AUTH cookie http://prntscr.com/97043
But everytime user logout-login, this value is different.
So what i want to know is:
Lets say i want to make 100% custom website, how i can make custom login?
Can you tell me all security issues about going for custom membership?
None of this is necessary. You can create your own users table without the need to alter anything related to Membership or authentication. You just make sure that your users table has a column called AspNetUserID or similar of type uniqueidentifier (a guid) . You put the ProviderUserKey from the MembershipUser in this table and lookup any user in your Users table simply by getting the ProviderUserKey from Membership.
So, for example, you might do this:
var userid = Membership.GetUser().ProviderUserKey;
// lookup your record in users based on userid above
Implementing a custom backend isn't difficult. You simply implement a custom MembershipProvider that stores and retrieves the data from your users table as you see fit. see MSDN. Also, you don't have to entirely rewrite SqlMembershipProvider, you can subclass it and add the functionality you're looking for.
If you really want to start from scratch on the backend, here are some issues to note:
Don't store passwords in plaintext anywhere; hash them.
Salt your passwords
Log & monitor password resets
Also, you don't have to entirely rewrite SqlMembershipProvider, you can subclass it and add the functionality you're looking for, and most of the issues you might run into will be covered by the default implementation. You'd probably just have slightly modify the data access calls or stored procedures to map to your table structure. You can also subclass the SqlRoleProvider to provide role-based authorization for your site with little additional effort.
As for the front-end component, MSDN also describes how forms authentication works, but personally, I wouldn't mess with your own cookie scheme. Even big custom implementations like Oauth for asp.net still use forms. Check out http://msdn.microsoft.com/en-us/library/system.web.security.sqlroleprovider.aspx

ASP.Net Membership additional field

I am starting a new ASP.Net MVC 3 app and I'm hoping to be able to use the built in Membership provider.
The issue I have is that my application can be used by various organizations and it is important that the information shown is only applicable to the organization the user is working for.
The no brainer approach would be to insist all users use their email addresses as their username so everyone is unique and can be associated with their respective organizations. The problem is, some users don't have email addresses so there is no reliable way of ensuring unique names and I don't want people to know the Usernames already in use by different organizations. (USernames should only be unique to the Organization, not the entire app)
Ideally, I would want the User to enter their organization name in one field, then their username in another (and then the password!)
So we could have Jane login from one organization.....
Organization Company1
Username Jane
Password ********
and then someone else also called Jane could login from a different organization..
Organization Company2
Username Jane
Password ********
So my question is, what is the best way of modifying the Membership system to allow for this extra field?
I'd go about writing a custom MembershipProvider to suite the requirement.
http://msdn.microsoft.com/en-us/library/f1kyba5e.aspx
The provider pattern used by membership is designed so that you can extend it. You can inherit from the default provider and from the default membership use class to add the fields you need. This saves you from having to write a provider from scratch. As #mare pointed out, there are potential pitfalls though.
I would overcome these by perhaps having a login form that prompts for organisation, username & password, but behind the scenes combine the org & username & use that as the internal username.
The built-in (default ASP.NET) membership provider does not provide a concept of an Organization/Company/Firm or Department. You will have create your own tables in the database for those with a foreign key to the aspnet_users table to be able to store that additional information (I wouldn't go changing the default aspnet_users table because it might make it incompatible with the current default provider or future ones). You will then need to use the default provider for the default functionality and create a Service class to support the extended functionality. I know, I have done it. It gets complicated and dirty, takes time but it's completely doable.
Most likely you will end up creating your own provider and that starts with the requirement to support Users in Companies. In case you thought that changing the default provider to support that wouldn't be necessary. The requirement about uniqueness within the company is another one you will have to implement.
I think there is a built in option in the membership. look into the APPLICATION field in table my_aspnet_users.
reference here:
http://msdn.microsoft.com/en-us/library/system.web.security.membership.applicationname.aspx

Use DBMS_CRYPTO to encrypt data

I'm currently using Oracle 10g. I use DBMS_CRYPTO package to encrypt the passwords of users for login. In order to encrypt or decrypt the data, I must have a key. So where should I put the key in order to hide it from other developers, or is there another way to encrypt data without being able to decrypt back?
In SQL Server, I just use PWDENCRYPT function to encrypt, and when I want to compare the data entered by the users correct or not, I use PWDCOMPARE. Pls advice. Thank you.
To hide the key from other developers, hopefully this article will be helpful, it includes a section on key management:
http://www.oracle.com/technology/oramag/oracle/05-jan/o15security.html
To encrypt data without being able to decrypt it back, you may wish to look into one way hashes. Oracle provides this in the form of DBMS_CRYPTO.HASH, which is simple to use (as discussed here):
SQL> select SYS.DBMS_CRYPTO.HASH('FFFFFF',1) from dual;
7D91F6D9BE28A9756B0D2F11D3AF4F0C
You then store only the hash in the database - you can verify the password if hashing the user input matches your stored hash, but you cannot retrieve the password in any way.

Resources