Looking for Suggestions on Creating Hash Key

[jwwest]

I'm building a CGI eCommerce store and I'm looking for ways to create
a decent 2 way encryption. Of course in a scripted language, I don't
want my key in the script itself, but would rather store it somewhere
obfuscated such as in a compiled C++ binary. (I know it doesn't help -
much-, but defense in layers)

A .NET programmer friend of mine uses a method that involves
generating a hash from the Volume ID of the hard drive to use as a
key. I like this approach, but my target platform is Linux which does
not have volume IDs (as far as I know).

Are there any freely available C++ libraries that provide hard drive
information such as cylinders, sectors, etc on which I can make a
string to base my hash? Has anyone done something like this before and
could share some tips?

[jwwest]

Re: Looking for Suggestions on Creating Hash Key

Of course since your application may be restored in a different system

in cases of hardware crashes, you better make sure these keys are only
used for transient data i.e. you do not store any encrypted data on
disk using them ...

That's the point of using a key based on hardware information. If, for
some reason the database and code was compromised (lost backup tape,
etc) it would be useless because the encryption algorithm depends on
the items being on a specific server. This would defeat individuals
restoring the database in a new environment. But yes, key management
would be a pain since I would need to have a copy of the key
available, and would need to decrypt/recrypt all entries in the
database in case of a hardware failure.

Thanks for the suggestion on /proc and /sys, I will check it out.

- James