If you look in the last article, we were writing the key we needed to decrypt to a simple little text file called sharedsampleKey.txt. Anyone who knows what’s what will be able to simply take your encrypted XML file and your key and write a little program to decrypt your data.

A triple-DES hash looks like a jumbled mess of 32 case-sensitive letters, numbers, and symbols, so, in the sharedsampleKey.txt file, we have a key that looks something like this: p4WyhV3GAAj3hG2PnXhfIDp5JGKJ6mqQ. Wouldn’t it be nice if we could make it just a little harder to read? Well you’re in luck, because there’s a couple ways we can do that.

The method I devised involves padding the key with some dummy keys, so that the would-be code-cracker would have to parse out the correct 32-character string from the garbage mess. But instead of writing out a few dummy keys and then sticking the real key on the end, or in some known place in the middle, I decided to cut the real key into pieces, to make it even harder to get the correct string. I know that sounds a little complicated, and it is, but hopefully looking at the code and reading the comments, it’ll make more sense:

 'this variable will hold our dummy key data
            Dim tDESkey As New TripleDESCryptoServiceProvider()
            'this will generate the real key we need to unlock the data
            Dim sharedkey As New TripleDESCryptoServiceProvider()
            'convert the key to a string
            Dim realkey As String = Convert.ToBase64String(sharedkey.Key)

            'open the file writer to write to a text file
            Dim writer1 As IO.StreamWriter = New IO.StreamWriter("C:\Temp\sharedsamplepaddedKey.txt")
            'convert the real key to a character array, so it'll be easier to slice the string up
            Dim ourkey() = realkey.ToCharArray

            'run a for loop with a step count of your choice
            '  I chose 15 to keep things simple
            For x = 0 To 15
                'generate a new key
                tDESkey.GenerateKey()
                'convert it to a string
                Dim str1 As String = Convert.ToBase64String(tDESkey.Key)
                'here I arbitrarily chose an iteration to insert the first half
                ' of my real key; remember how many iterations you used for later
                If x = 4 Then
                    'A nested for loop to write out the first 16 characters
                    For i = 0 To 15
                        writer1.Write(ourkey(i))
                    Next i
                    ' another arbitrary iteration number, a few cycles later
                ElseIf x = 8 Then
                    'start where we left off and write out the last 16 characters
                    For i = 16 To 31
                        writer1.Write(ourkey(i))
                    Next i
                Else
                    'otherwise, just write a dummy key
                    writer1.Write(str1)
                End If
                'continue the loop
            Next x
            'close the file writer
            writer1.Close()

If you go look at the sharedsamplepaddedKey.txt file, you’ll see a nice jumbled mess of code that’ll be harder to crack. But because we know our arbitrary positions that we inserted each half of the key, we can use the the String.Remove() method to cut through the junk characters and piece together our real string. We can do that by:

 'A variable to hold our final, real key
            Dim sharedkey As New TripleDESCryptoServiceProvider()

            'open the file with a streamreader
            Dim rd2 As IO.StreamReader = New IO.StreamReader("C:\Temp\sharedsamplepaddedKey.txt")
            'read the contents from the file into a string
            Dim testStr As String = rd2.ReadToEnd()
            'Console.WriteLine(testStr)
            'Here's where it gets a little tricky
            ' Assuming you used the code above, we wrote out 4 full dummy
            ' keys before we inserted the first half of the real one, and
            ' each key is 32 characters long. So starting from 0 (the very
            ' beginning of the line, we remove 128 characters (32 x 4 = 128)
            testStr = testStr.Remove(0, 128)
            'Now, we have the first half (16 characters) so we need to KEEP
            ' those and then cut away 3 more lines to get to the next half
            ' so we start at position 16 and cut away 96 more characters
            testStr = testStr.Remove(16, 96)
            'We have the full 32-character key! but we need to cut away the
            ' trailing 7 lines so we jump 32 characters in, and remove 224
            ' more pieces of junk
            testStr = testStr.Remove(32, 224)
            Console.WriteLine(testStr)
            'then we convert the string to a byte array...
            Dim bytedata() As Byte = Convert.FromBase64String(testStr)
            '...and set our key's value! Hooray!
            sharedkey.Key = bytedata

Refer to the previous article on how to use the key to decrypt the data.

Expanding the Obfuscation

This is a fairly simple way of going about things, and it still is crackable, but this way it’s harder to figure out what the real key is. But, you can make it even harder! You can split the real key up into as many pieces as you want, but it’s going to make your String.Remove()’s a bigger pain when trying to build the real key. You can pad it with a ton more dummy keys, or you could be tricky and start reversing parts of the real key; you’ll just have to remember all the steps you took to hide the real key, and the more you use, the sturdier your defenses. But the more you use, the more you have to remember, so it’s all really about how much trouble you want to go through to protect the data and your own personal paranoia. In the end, everything can be cracked, but it never hurts to make it harder to do so.

There may be a way easier or better way to do all of this, but this was still a fun exercise in Visual Basic.NET. Suggestions, pointers, and questions are welcome – I’m not really a VB’er by trade, and I love getting new info, but hopefully this is helpful to someone.

But, the easy readability of XML comes at a price: if you’re storing sensitive data, any person who can read has a pretty good shot at understanding it. So, I went on a quest to find out ways to password-protect or encrypt XML files, and found out that recently the .NET framework began supporting a few easy to use methods to make encryption/decryption a fairly simple task. I’ll cover both of these, with some caveats, in Visual Basic .NET, since that’s the language I’ve been writing in.

I’ll make the assumption that if you’re writing this code, you’re probably using one of the iterations of Visual Studio, since it’s pretty great for writing anything .NET related. I’ll also assume that you know how to create and understand XML files, or at the very least have a sample file you’re willing to use, and that you have basic knowledge of programming in VB. Of course, questions are always welcome!

Before you do anything in your project, you’ll want to make sure you add references to the Security classes in the framework by right clicking on the project’s name and clicking on “Add Reference” which should make a window pop up with a massive list of different libraries. Scroll down to System.Security, click on it, and then click the Add button. You might be able to get away with skipping this step, but any time I’ve needed to use the XML Security libraries, Visual Studio has had trouble finding the methods I was trying to use, and adding the reference has always solved those problems.

First, you’ll want to import the appropriate things for dealing with the encryption:

Imports System.Xml
Imports System.Security.Cryptography
Imports System.Security.Cryptography.Xml

The code for encryption is below. I like to stick it in a “Save Button” or similar subroutine, where it copies whatever XML document I’m working with and saves it to the encrypted file.

'Declare an object that will load the XML file
        Dim xmldoc As New XmlDocument()

        'Always use the TRY/CATCH block to catch exceptions
        Try
            'Load the XML file
            '  Note that it says "decrypted.xml" (we're either beginning with a new document, or one that has been
'   decrypted when the program loaded so we could work with it)
            xmldoc.Load("C:\Temp\decrypted.xml")

            'Create a shared key using the triple DES algorithm
            '  Useful if we want to use this XML file across different applications
            Dim sharedkey As New TripleDESCryptoServiceProvider()
            'Declare a writer to save the key to a file (I use C:\Temp\ for my directory of choice
            Dim writer As IO.StreamWriter = New IO.StreamWriter("C:\Temp\sharedsampleKey.txt")
            'Convert the key to a String
            Dim str As String = Convert.ToBase64String(sharedkey.Key)
            'Write the string to the file
            writer.WriteLine(str)
            'Close the writer since we're done with it
            writer.Close()

            'Create an encrypted XML object and give the constructor our loaded XML file
            Dim exml As EncryptedXml = New EncryptedXml(xmldoc)

            'Select the XML node/element to be encrpyted
            '  You can select single nodes to encrypt, or choose the root node to encrypt the entire document
            Dim encryptElement As XmlElement = CType(xmldoc.SelectSingleNode("/cookbook"), XmlElement)

            'Encrypt the XML element data using the TripleDES alogrithm and save the results into a byte array
            Dim encryptXML As Byte() = exml.EncryptData(encryptElement, sharedkey, False)

            ' Create an EncryptedData object and tell it how we're encrypting it
            Dim ed As New EncryptedData()
            ed.Type = EncryptedXml.XmlEncElementUrl
            ed.EncryptionMethod = New EncryptionMethod(EncryptedXml.XmlEncTripleDESUrl)
            ' Create a CipherData element
            ed.CipherData = New CipherData()
            'Tell the cipher what we're encrypting
            ed.CipherData.CipherValue = encryptXML
            'Replace the node with the encrypted content
            EncryptedXml.ReplaceElement(encryptElement, ed, False)

            'Save the encrypted version of XML to disk
            xmldoc.Save("C:\Temp\encrypted.xml")

            deleteLbl.Visible = False
            messageLbl.Visible = True
            messageLbl.Text = "Recipe Data Saved"
        Catch ex As Exception
            MessageBox.Show(ex.Message)
        End Try

In the above code, I alluded to decrypting the file so that it’s easier to work with in your program, and if you plan on encrypting data, it doesn’t do you much good if you can’t go back and read it later. Here’s how the decryption process works, if we assume that you used the method above to encrypt your XML in the first place. I like to put this in the Form’s Load subroutine, or you could put it in a “Load File” button, for example.

 Try
            'create a shared key object that we'll use to "unlock" our data
            Dim sharedkey As New TripleDESCryptoServiceProvider()

            'Retrieve shared key from the stored location
            Dim rd As IO.StreamReader = New IO.StreamReader("C:\Temp\sharedsampleKey.txt")
            'read the string fromt he file and convert it to a byte array
            Dim bytedata() As Byte = Convert.FromBase64String(rd.ReadToEnd())
            'set the key in the object
            sharedkey.Key = bytedata

            'Declare an XML object and load our encrypted content
            Dim encryptedDoc As New XmlDocument()
            encryptedDoc.Load("C:\Temp\encrypted.xml")

            'Grab whatever it is that we've encrypted
            Dim EncryptedElement As XmlElement = CType(encryptedDoc.GetElementsByTagName("EncryptedData")(0), XmlElement)

            'Create an EncryptedData object
            Dim ed As New EncryptedData()
            'Load the encrypted node into our ED object
            ed.LoadXml(EncryptedElement)

            'Use the key and the DecryptData method to get the original text
            Dim encryptXML As New EncryptedXml()
            Dim decryptedXML As Byte() = encryptXML.DecryptData(ed, sharedkey)

            'Replace the encryped node with the decrypted one
            encryptXML.ReplaceData(EncryptedElement, decryptedXML)
            'Save the data to a decrypted file
            encryptedDoc.Save("C:\Temp\decrypted.xml")
            'close our stream reader
            rd.Close()
        Catch ex As Exception
            Messag

Caveats

The above methods are really only for demo purposes, but in production, you’ll want to be a little more careful with your data. For example, using the above, you’ll take an encrypted file, decrypt it, and save it to the hard disk. Unless you delete it, the data will be there for just anyone to read. That being said, you should delete it once you’re done working with it (obviously), by using something like the below:

Private Sub frmMain_Closing(ByVal sender As Object, ByVal e As System.ComponentModel.CancelEventArgs) Handles MyBase.Closing
        Dim FileToDelete As String

        FileToDelete = "C:\Temp\decrypted.xml"

        If System.IO.File.Exists(FileToDelete) = True Then
            System.IO.File.Delete(FileToDelete)
        End If

    End Sub

Or, conversely, you could stick to using one file and just overwrite the encrypted file’s XML with the decrypted XML using the methods above, but you’d have to make sure you encrypt it again when you’re done with it.

Then, there’s the matter of the key. It’s just sitting there next to the data, but when you hide a spare key in your backyard, you probably don’t leave it taped to your door. Anyone with sense could break in just as easily if you’d left it unlocked. So, that said, you want to keep your shared key in a less-than-obvious place. And then, you may want to pad your key with a few hundred extra characters just to throw off anyone who finds it. I’ll probably write another post soon describing what I mean, but for now, it’s back to work for me!

Further Reading

• Triple DES on WikiPedia
• MSDN Cryptography Namespaces

I’ve got a bunch of steps planned for you, and if you are familiar with Illustrator, you can probably skip a couple. I tried to write it so someone fairly new to the software can follow along easily. Of course, if you have another method of your own that you love to use, feel free to share it! Now, on with the tutorial:

Step 1: Create a rectangle using the shape tool. Make it whatever color you want; I chose blue since we're making a wave.

Step 2: With the rectangle selected, click Filter -> Distort & Transform -> Zig-Zag

Step 3: The default settings are okay, but you can play with the settings to adjust the height of your wave. Make sure the preview box is clicked if you want to see what will happen to your rectangle.

Step 4: With the shape selected, click on Object -> Expand Appearance. We do this because illustrator treats the shape like it's still a rectangle after you apply the zig zag filter. Expanding the appearance converts your shape into an object with its own control points, allowing us to directly manipulate the path.

Step 5: Now, we want this to repeat, so we need to just take a portion of our shape. Luckily for us, the Zig Zag filter spaces out all of the waves evenly in a sine-wave type pattern, so we can pick a start point and end point to make an image that will repeat nicely when we use it in our HTML/CSS. Here we need to use the direct selection tool (the white arrow, not the black one...or hit "A" if you're into hotkeys) and select the wacky, wavy end of the shape.

Step 6: Hit the delete key to remove the junk from the end. But now, the path is open, and we want to close it! Grab the pen tool (P for the hotkeyers) and click on the top point (a little / should appear next to the pen nib) and then click on the bottom point (a little o should appear) to close the path up. This is helpful for the next step.

Step 7: Get the direct selection tool out again, and this time select the junk to the right. Make sure you draw a box to the right of the center of the next trough or "low point" after the crest, or "high point" of the wave. You'll notice that everything left of the crest is half of a trough, and everything to the right is another half. This is how we create a seamlessly repeating pattern.

Step 8: Delete the junk, and you'll see we have a single crest. If you want just a wavy ribbon, you can stop here, but I needed a boxy bottom to my wave since it was going to be used in a page footer. If you want to keep following along, go ahead and close the ends with the pen tool like we did in step 6.

Step 9: Use the direct selection tool to grab the lower center point of the shape. This picture here shows that a white square should show up, indicating that you can select the point.

Step 10: Delete it! This will square up the bottom of your wave, making it ideal for a border of any kind. Here, you can change the color, add a gradient, or copy and paste it into photoshop to do more work on it. Read on for a couple more steps on how to publish it using Illustrator if you don't have Photoshop, or prefer to use only Illustrator.

Step 11: Click the crop artboard tool. This will make the area outside the artboard turn gray, indicating that you are resizing the visible area of the final image.

Step 12: Illustrator will handily crop the artboard automatically for you to fit everything into the image. So, just click on the wave, and voila! It'll resize the artboard to perfectly contain your wave.

Step 13: Select any other tool to close the crop artboard tool. You can now save the file for web use using File -> Save for Web and Devices. This will optimize the file for web use. You can save it in any format you wish, but I would recommend using GIF or PNG, since they support transperency, and they use "lossless" compression, so that we don't have to worry about "artifacting" the edges of our wave.

Here’s a quick line of CSS to demonstrate how to use the wave:

.element{ background: url(path/to/wave.gif) repeat-x; }

That’s it in a nutshell! I hope the tutorial was easy to follow, but if there’s problem spots, feel free to ask questions and/or ridicule me in the comments! Now…back to work on other things. I’ll try to come back sooner than later with another post.

In the meantime, I’ll be working on client projects. We’re doing some cool stuff with a point of sale system, and then integrating a load cell with a code project. I’ll try to share what I learn here, if of course it won’t give away too many secrets!

I also have plans to make a little rock-paper-scissors game using HTML5 and JavaScript, so that way I’ll be able to say I’ve actually used HTML5, and it will be fun to develop. More coming soon!

Below is the entirety of the class. You can paste it directly where you want to use it, but I like to keep my classes in their own file. I named mine “weather.class.php,” for example. I’m making the assumption you know a little bit of PHP.

/************************************************
/ Class: WeatherData
/ Author: Beau Watson
/ Version: 1.1
/ Description: Uses the Yahoo Weather RSS API to get
/  weather info for US cities by zip code
/ Special Thanks: Navarr Barnier (tech.navarr.me)
/************************************************/
class WeatherData
{
private $url; //variable to store our url
private $cond; //variable to store our condition
private $temp; //variable to store our temperature
private $humidity; //variable to store our humidity
private $units; //variable so we can set units f=farenheit, c=celsius
private $data; //array to hold our weather data from Yahoo
private $matches; //array to hold our regex matches
private $xml; //variable to hold the xml data from the RSS feed
private $item; //variable to hold the node we're looking at

//Constructor intializes properties of the class
//pass it a zip code, you can also define units
//defaults to farenheit, but pass in c for celsius
public function __construct( $zip, $units = "f")
{
if($this->units != "c"){
$this->units = "f";
}

//set the url given the things passed into the constructor
$this->url       = 'http://weather.yahooapis.com/forecastrss?p='.$zip.'&u='.$units;
//open the file
$this->xml = file_get_contents($this->url);
//reead it using SimpleXML
$this->xml = simplexml_load_string($this->xml);
//we grab the channel node using simpleXML
$this->item = $this->xml->channel[0]->item[0];
//here we set the namespace we're looking for using yahoo's spec
$yweather = $this->item->children("http://xml.weather.yahoo.com/ns/rss/1.0");
//we have to redeclare a second namespace to use since yahoo's API sticks the
//  humidity data that we need in a different tag
$yweather2 = $this->xml->channel->children("http://xml.weather.yahoo.com/ns/rss/1.0");
//we grab all of the attributes of the yweather tag for the conditions
$attr = $yweather->condition->attributes();
//we grab the temp attribute and set the temperature property
$this->temp     = $attr["temp"];
//we grab the condition type and set the property
$this->cond     = $attr["text"];
//we use our attribute finder and our other namespace to get
// the atmosphere tag, where we get the humidity data
$attr = $yweather2->atmosphere->attributes();
//set the humidity property
$this->humidity  = $attr["humidity"];

}

//magic function for setting variables
public function __set($var, $val)
{
$this->$var = $val;
}

//magic function for returning variables
public function __get($var)
{
return $this->$var;
}

}

Using the class in your scripts (assuming you put it in its own file):

//include the file using whatever name you gave it
include_once("weather.class.php");

//create a new weather object
//make sure you pass in a zip code
//if you want to specify units, pass in "c" as a string for celsius
// units default to farenheit
$weather = new WeatherData($zipcode, $units);

//to access the members, call them like so
$weather->cond; //for the condition, eg "Sunny"
$weather->temp; //for the temperature
$weather->humidity; //for the humidity

Since I only needed these three aspects of the weather, that’s all I bothered to include in the class. If you need more data, you can ask me and I can help you figure it out. There are many ways you could implement this class in your work as well, but I’ll save those ideas for another post.

Special thanks to my buddy, Navarr Barnier, for helping me integrate SimpleXML with this class.

I’ve been busy with work, but intend to spend a little time learning about developing for this thing this weekend, and will be sure to post my findings as they come!