Binary_Checksum - How secure is it?

Hi,
In one of my client's database some confidential information is stored in an
encrypted format and a different column has the original value in a
Binary_Checksum format.
For example, if 'abc' is a password, its first encrypted and put in Column1.
But a Binary_Checksum of 'abc' is stored in Column2 for comparison purposes.
I am just wondering whether this is secure. Can't the Binary_Checksum value
(26435) be reversed to get the original 'abc'?
Thank you.
Regards,
KarthikHi Karthik,
The hashes generated are only 32 bits long, which is tiny. BOL states that
the probability of a collision is higher than that of the MD5 one-way hash
function, which itself is considered insecure at this point. This means a
hacker has a much greater chance of guessing the password with brute force
or dictionary attacks. Consider the following sample run in SQL 2005:
SELECT BINARY_CHECKSUM('AAAAAAAAAAAAAAAAA')
SELECT BINARY_CHECKSUM('A')
The first thing to notice is the simplicity of the algorithm.
BINARY_CHECKSUM('A') returns 65, which is the ASCII code for.. what else?
'A'. Both of the SELECT statements above produce the same result. Someone
trying to hack this particular system where you use BINARY_CHECKSUM to hash
the password will have a pretty easy time of getting some generated string
to match that hash. I would switch to another hash algorithm like SHA or
something.
"Karthik" <Karthik@.discussions.microsoft.com> wrote in message
news:0AC981BD-2919-496D-9572-D7F5EA38F3A8@.microsoft.com...
> Hi,
> In one of my client's database some confidential information is stored in
> an
> encrypted format and a different column has the original value in a
> Binary_Checksum format.
> For example, if 'abc' is a password, its first encrypted and put in
> Column1.
> But a Binary_Checksum of 'abc' is stored in Column2 for comparison
> purposes.
> I am just wondering whether this is secure. Can't the Binary_Checksum
> value
> (26435) be reversed to get the original 'abc'?
> Thank you.
> Regards,
> Karthik|||Karthik (Karthik@.discussions.microsoft.com) writes:
> In one of my client's database some confidential information is stored
> in an encrypted format and a different column has the original value in
> a Binary_Checksum format.
> For example, if 'abc' is a password, its first encrypted and put in
> Column1. But a Binary_Checksum of 'abc' is stored in Column2 for
> comparison purposes.
> I am just wondering whether this is secure. Can't the Binary_Checksum
> value (26435) be reversed to get the original 'abc'?
I believe the checksum algorithm is not very sophisticated at all, it only
performs some XOR operations. Then again, it's a destroying
transformation. There are many strings that gets the same checksum. So
it's not completely trivial to guess the original text. Unless, of
course, you already have an idea of what it could be.
So it's not certainly not as secure as a real encrypted value.
Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se
Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/pr...oads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodin...ions/books.mspx|||You need to educate them on the definition of "encrypted" versus "encoded".
It's generally accepted that encrypted means some type of key is required to
decrypt the data, whether it's a certificate or a password. Encoded means no
key is required. You're talking about encoded here.
Ray

> In one of my client's database some confidential information is stored in
> an
> encrypted format|||Any checksum is simply Character by Character XOR. This is the same as for
RAID parity, .zip checksums, etc. It is not intended to be used for
encryption.
It is based on the fact that the XOR operator is commutative and transitive:
A XOR B = C = B XOR A,
B XOR C = A = C XOR B, and
C XOR A = B = A XOR C,
Which is why PARITY works.
Encryption works the same way, which is why you can decrypt. However, to
make it more secure, instead of XORing the characters together, the original
values are XORed with a fixed algorithm hash. The method of constructing
this hash is what determines the strength of the algorithm.
The hash for a checksum is 0, which is extremely simple to hack: I just told
you what it was; no big secret.
Sincerely,
Anthony Thomas
"Karthik" <Karthik@.discussions.microsoft.com> wrote in message
news:0AC981BD-2919-496D-9572-D7F5EA38F3A8@.microsoft.com...
> Hi,
> In one of my client's database some confidential information is stored in
an
> encrypted format and a different column has the original value in a
> Binary_Checksum format.
> For example, if 'abc' is a password, its first encrypted and put in
Column1.
> But a Binary_Checksum of 'abc' is stored in Column2 for comparison
purposes.
> I am just wondering whether this is secure. Can't the Binary_Checksum
value
> (26435) be reversed to get the original 'abc'?
> Thank you.
> Regards,
> Karthik|||Hi Mike, Erland, Ray and Anthony,
Thank you for all the valuable input. I will present these facts to my
client. Hopefully he will agree for a proper hash rather than
binary_checksum()
Thank you!
Regards,
Karthik
"Mike C#" wrote:

> Hi Karthik,
> The hashes generated are only 32 bits long, which is tiny. BOL states tha
t
> the probability of a collision is higher than that of the MD5 one-way hash
> function, which itself is considered insecure at this point. This means a
> hacker has a much greater chance of guessing the password with brute force
> or dictionary attacks. Consider the following sample run in SQL 2005:
> SELECT BINARY_CHECKSUM('AAAAAAAAAAAAAAAAA')
> SELECT BINARY_CHECKSUM('A')
> The first thing to notice is the simplicity of the algorithm.
> BINARY_CHECKSUM('A') returns 65, which is the ASCII code for.. what else?
> 'A'. Both of the SELECT statements above produce the same result. Someon
e
> trying to hack this particular system where you use BINARY_CHECKSUM to has
h
> the password will have a pretty easy time of getting some generated string
> to match that hash. I would switch to another hash algorithm like SHA or
> something.
> "Karthik" <Karthik@.discussions.microsoft.com> wrote in message
> news:0AC981BD-2919-496D-9572-D7F5EA38F3A8@.microsoft.com...
>
>

binary varbinary question

What is the documented and known behavior of inserting hex constants into a
binary/varbinary column from a client to a server which have different code
pages? Will any code page / character set conversion take place?
eg: insert into t1 values ('AA') or insert into t1 values(x'AA')
Thanks
AakashYou can specify a binary (hex) constant as 0x followed by the character
representation of the hex string. These are not enclosed in quotes.
For example:

INSERT INTO t1 VALUES(0xAA)

This is documented in the SQL Server 2000 Books Online
<tsqlref.chm::/ts_ca-co_1n1v.htm>. Since the value is not a character
value, no character conversion occurs.

--
Hope this helps.

Dan Guzman
SQL Server MVP

--------
SQL FAQ links (courtesy Neil Pike):

http://www.ntfaq.com/Articles/Index...epartmentID=800
http://www.sqlserverfaq.com
http://www.mssqlserver.com/faq
--------

"Aakash Bordia" <a_bordia@.hotmail.com> wrote in message
news:bf4j62$688$1@.hanover.torolab.ibm.com...
> What is the documented and known behavior of inserting hex constants
into a
> binary/varbinary column from a client to a server which have different
code
> pages? Will any code page / character set conversion take place?
> eg: insert into t1 values ('AA') or insert into t1 values(x'AA')
> Thanks
> Aakash

big problems with MMC Console

hi @.ll
we have a couple of sql server and by one server we have big problems with
the
enterprise console (MMC). We use the MMC console on our client and to load
the Item "Database" the console need more as 2 min
on all other server the load is done in 5-10sec.
DNS looks fine
Wins looks fine
Windows Authentification looks fine
has anybody a idea what's wrong?
klaus
Hi
Check that the databases are not set to "Auto Close" as this really impacts
the iteration of databases on the server.
Regards
Mike Epprecht, Microsoft SQL Server MVP
Zurich, Switzerland
IM: mike@.epprecht.net
MVP Program: http://www.microsoft.com/mvp
Blog: http://www.msmvps.com/epprecht/
"Klaus" <klaus.bilger@.c-s-l.biz> wrote in message
news:OOkN7gdNFHA.3772@.TK2MSFTNGP15.phx.gbl...
> hi @.ll
> we have a couple of sql server and by one server we have big problems with
> the
> enterprise console (MMC). We use the MMC console on our client and to
load
> the Item "Database" the console need more as 2 min
> on all other server the load is done in 5-10sec.
> DNS looks fine
> Wins looks fine
> Windows Authentification looks fine
> has anybody a idea what's wrong?
> klaus
>

BIDS problem

I just installed the RTM of the standard version of SQL Server 2005 Client Tools on a Windows XP machine.

When I initially opened the SQL Server Business Intelligence Development Studio, I received about 6 pop-up messages saying that it couldn't load a package (I didn't copy the message and can't get it to repeat now).

When I try to create an Analysis Services package, I now get the message:
"Could not load type 'Microsoft.VisualStudio.Shell.Interop.IVsHasRelatedSaveItems' from assembly 'Microsoft.VisualStudio.Shell.Interop.8.0, Version=8.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"

I believe this is some sort of setup issue, but am not sure how to troubleshoot or fix this.

Thanks for your help,
Jessica

I'm getting the exact same error when I try to create a new report. Any luck in figuring it out?

|||FYI - I found the solution in case you are still looking. Go here http://forums.microsoft.com/msdn/showpost.aspx?postid=2098&siteid=1|||Thanks Mike! That did the trick :-D

BIDS problem

I just installed the RTM of the standard version of SQL Server 2005 Client Tools on a Windows XP machine.

When I initially opened the SQL Server Business Intelligence Development Studio, I received about 6 pop-up messages saying that it couldn't load a package (I didn't copy the message and can't get it to repeat now).

When I try to create an Analysis Services package, I now get the message:
"Could not load type 'Microsoft.VisualStudio.Shell.Interop.IVsHasRelatedSaveItems' from assembly 'Microsoft.VisualStudio.Shell.Interop.8.0, Version=8.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"

I believe this is some sort of setup issue, but am not sure how to troubleshoot or fix this.

Thanks for your help,
Jessica

I'm getting the exact same error when I try to create a new report. Any luck in figuring it out?

|||FYI - I found the solution in case you are still looking. Go here http://forums.microsoft.com/msdn/showpost.aspx?postid=2098&siteid=1|||Thanks Mike! That did the trick :-D

BI Dev Studio Licensing

I have a client that we're hosting a website for and we have a few reports
that we've done for them. They're wanting to create and publish their own
reports now and I'm wondering what to buy. They picked up Visual Studio Standard
Edition because on the MSDN site it says Standard does Reporting Services,
but after installing it, there's no Reporting Services Project type. I tried
having them install the client tools for SQL 2005 but the installer said
Reporting Services tools were already installed, not making much sense. How
exactly do I get them the BI Development Studio and does that require another
SQL 2005 license?SQL Server 2005 is licensed by the Server. There is no license for the
development tools. Unlike RS 2000, it ships with a version of VS if it is
not installed. If you have VS 2005 installed then it will install into that.
It doesn't make sense that it says the tools are already installed. I have
VS 2005 (because I needed VB.Net) and then installed VS 2005 BI on top of
that. VS 2005 has controls for Reporting Services IF you are creating your
own website or windows app. If all you want to do is create reports what you
want to do is install the BI client tools found on the SQL Server 2005 CD.
They can uninstall VS and any BI tools they find and then try again.
Bruce Loehle-Conger
MVP SQL Server Reporting Services
"Josh Belden" <joshuabelden@.hotmail.com> wrote in message
news:dee73200137b98c7f6131ce52f7c@.news.microsoft.com...
>I have a client that we're hosting a website for and we have a few reports
>that we've done for them. They're wanting to create and publish their own
>reports now and I'm wondering what to buy. They picked up Visual Studio
>Standard Edition because on the MSDN site it says Standard does Reporting
>Services, but after installing it, there's no Reporting Services Project
>type. I tried having them install the client tools for SQL 2005 but the
>installer said Reporting Services tools were already installed, not making
>much sense. How exactly do I get them the BI Development Studio and does
>that require another SQL 2005 license?
>

beta headache

Hi Folks,

I'm still using the the SQL Server 2005 June CTP to develop. I'm working for a client that intends to upgrade, but has not done so yet. We believed that we had 365 days from the date of installation before it would expire (late July). But Visual Studio 2005 Beta 2 just expired, which is used by SQL Server Business Intelligence Development Studio, so now we can no longer develop SSIS packages or Reporting Services reports.

What can I do?

I thought that maybe installing Visual Studio 2005 express might work, but when I went there, it seems that it is split up into modules (e.g. Visual Basic 2005 express, Visual C++ express, etc...). I don't know if just one of these would be sufficient and if so, which one. Even if it would, it says I'll need to completely remove the SQL Server 2005 beta, as well as the Visual Studio 2005 beta, and I think the .net framework.

My contract is up at the end of June, and it was understood that the client was going to take care of the upgrade. Is there a quick fix here? What can I do with minimal effort? (I don't really have time to wait for the client to get the upgrade approved and done. I know, sniff, sniff! lol.)

Uninstalling and reinstalling really shouldn't be terribly time consuming. You should definitely get off the betas and onto released software. For SQL, you can go straight to Express at SP1 level (i.e., don't bother installing Express RTM because the remastered version with SP1 bits is now available, and better). If you don't have stuff in master like special logins, a simple uninstall/reinstall will be easiest. If you do feel a need to retain the Master database, use the special /savesysdb switch when you uninstall and then you can carry all that stuff over to the current build.

Sorry, I don't have any answers for you on the Visual Studio Express bits to use. I'm sure they've got a forum up here where you can ask that question.

Best way to insert data to MSDE db

Hello.
I'm creating a stand-alone windows application using the MSDE server.
Performance issues in this application are big-deal to my client.
I need to insert data to the database in rate of – 2MB / sec.
Each insert action should insert ~ 10-40 MB to the database.
My questions are:
1. What is the fastest way to INSERT data to the database? Using insert from
c# code, scripts, stored procedure, other?
2. What is the fastest way to retrieve information from the database?
Thanks.
hi,
Eli wrote:
> Hello.
> I'm creating a stand-alone windows application using the MSDE server.
> Performance issues in this application are big-deal to my client.
> I need to insert data to the database in rate of - 2MB / sec.
> Each insert action should insert ~ 10-40 MB to the database.
> My questions are:
> 1. What is the fastest way to INSERT data to the database? Using
> insert from c# code, scripts, stored procedure, other?
nope... the fastest insert method is BULK INSERT (via BULK INSERT statement
or BCP.exe) that can even advantage from combined CPUs... and using BULK
LOGGED recovery model will help ...

> 2. What is the fastest way to retrieve information from the database?
data retrival is demanded to SELECT statements, and you have non other
ways.. you can optimize your index design to make the application works
better, you can even over-index your structure, but this will slow down
insertions..
Andrea Montanari (Microsoft MVP - SQL Server)
http://www.asql.biz/DbaMgr.shtmhttp://italy.mvps.org
DbaMgr2k ver 0.11.1 - DbaMgr ver 0.57.0
(my vb6+sql-dmo little try to provide MS MSDE 1.0 and MSDE 2000 a visual
interface)
-- remove DMO to reply
|||Thanks for the quick response.
Can you direct me to a link of how to implement the command by code ?
I'm working with C#, and need to send the data from the code.
Do you know of a way to insert the data has an object?
I mean, the rows I want to insert are allready in a class/struct format, and
sending them as-is to the database, insetd of parsing them to insert command,
will be, I think,a fast way. What do you think?
"Andrea Montanari" wrote:

> hi,
> Eli wrote:
> nope... the fastest insert method is BULK INSERT (via BULK INSERT statement
> or BCP.exe) that can even advantage from combined CPUs... and using BULK
> LOGGED recovery model will help ...
>
> data retrival is demanded to SELECT statements, and you have non other
> ways.. you can optimize your index design to make the application works
> better, you can even over-index your structure, but this will slow down
> insertions..
> --
> Andrea Montanari (Microsoft MVP - SQL Server)
> http://www.asql.biz/DbaMgr.shtmhttp://italy.mvps.org
> DbaMgr2k ver 0.11.1 - DbaMgr ver 0.57.0
> (my vb6+sql-dmo little try to provide MS MSDE 1.0 and MSDE 2000 a visual
> interface)
> -- remove DMO to reply
>
>
|||hi,
Eli wrote:
> Thanks for the quick response.
> Can you direct me to a link of how to implement the command by code ?
> I'm working with C#, and need to send the data from the code.
> Do you know of a way to insert the data has an object?
> I mean, the rows I want to insert are allready in a class/struct
> format, and sending them as-is to the database, insetd of parsing
> them to insert command, will be, I think,a fast way. What do you
> think?
>
unfortunately BULK operations only supports flat data format and not
structured formatted data... you can use CSV, native SQL Server exported
data via BCP and so on, but not data from xml files and the like...
BULK operations accept a (txt) file to be imported, as described in
http://msdn.microsoft.com/library/de...ba-bz_4fec.asp
Andrea Montanari (Microsoft MVP - SQL Server)
http://www.asql.biz/DbaMgr.shtmhttp://italy.mvps.org
DbaMgr2k ver 0.11.1 - DbaMgr ver 0.57.0
(my vb6+sql-dmo little try to provide MS MSDE 1.0 and MSDE 2000 a visual
interface)
-- remove DMO to reply