Security Risks in the Encryption of Database Connection Strings

ABSTRACT Background There exists an important and open problem with the encrypting of database connection strings in that related connection strings start with well known identical initial sub‐strings. When these initial sub‐strings are longer than the encrypting algorithm's block size, the resulting encrypted text for related database connection strings will have identical initial sub‐strings which could increase the chance of breaking the encryption key used to encrypt the connection strings. Aims The objective of our work was to find a simple, easy to implement, well known algorithm that would eliminate the identical initial sub‐strings in the encrypted text of related database connection strings. Methods Our methodology was to apply an obfuscation function to the database connection strings before encrypting them with the 3DES and AES encryption algorithms. The obfuscation functions we chose for our tests were the Roman Keyword cipher or the Greek Scytale cipher. Discussion The results of applying the two obfuscation functions to the related database connection strings before encrypting them with the symmetric encryption algorithms. This process effectively eliminated the commonality in the encrypted text of the database connection strings. Conclusion While both the Keyword and Scytale obfuscation functions were able to eliminate the commonality in the encrypted text. We found that the Scytale function was superior to the Keyword function due to some minor limitations of the Keyword functions and the fact that the Scytale function geometrically increased the number of possible known strings within the plain text connection string before encryption.