Encrypt and Decrypt data in COBOL

murugan_mf · Posted: Tue Jul 10, 2012 1:50 pm

Hi All,
We have a task where we need to mask some account numbers in a
dataset. Actually we thought of writing a program to encrypt and
decrypt.
I wanted to know if is there any other way this can be done?

Soliciting thougths.

Bill Woodger · Posted: Tue Jul 10, 2012 1:54 pm

You want to encrypt? Or you want to garble so that live client data cannot reasonably be revealed?

murugan_mf · Posted: Tue Jul 10, 2012 2:14 pm

we Prefer to encrypt the data

Bill Woodger · Posted: Tue Jul 10, 2012 2:21 pm

Talk to your technical support to see what is available at your site.

If nothing already, your best bet would be to buy something in. Or allocate a lot of time/money to implement and test it yourselves.

Robert Sample · Posted: Tue Jul 10, 2012 2:34 pm

If your goal is to meet PCI standards, your site needs to buy something to do the encryption. Implementing an acceptable (under PCI) encryption method is not a simple task.

murugan_mf · Posted: Tue Jul 10, 2012 2:52 pm

Thsi we are doing it internally and not required to met PCI standards.

Bill Woodger · Posted: Tue Jul 10, 2012 2:54 pm

If you use a very simple "encryption" it won't be very secure but won't cost as much in resources.

But really, why do you want to encrypt but not do it properly?

murugan_mf · Posted: Tue Jul 10, 2012 3:03 pm

We dont want to let users to see some confidential information and that is reason we planning to write a program to do that..but before we define our own rules to write a program, i am just want to know will this can be done in any other way.

Bill Woodger · Posted: Tue Jul 10, 2012 3:06 pm

Really? How are they getting to see the data? They have TSO/ISPF access?

Even so, why would you need the decrypt? For what you've said, either don't show it to them, or garble it.

Explain further, please.

murugan_mf · Posted: Tue Jul 10, 2012 3:29 pm

Yes, some users will have.
First of all we dont want to open up with all the available account numbers.
after analysing the data(only a/c no will be encrypted) and any discrepencies found with the record then they will come back to us asking the account number.
During that instance we need to decrypt the record alone and give back to them.

Nic Clouston · Posted: Tue Jul 10, 2012 4:57 pm

If they are going to have acces anyway when they come across an anomolie why not just give them the access to start with and save all the hassle? Either they are authorised or they are not. If not then have the security software stop them from looking at the data. If you still want to mask the account numbers then look in the DFSort forum - someone was doing that the other month.

Anuj Dhawan · Posted: Tue Jul 10, 2012 6:43 pm

It might sound rude but - before one attempts to do what you say, one need to understand the basic difference between encryption and garble-the-data. There are commercially available products that do field level encryption; use one of them to encrypt the data as you copy from one place to another -- commercial products are available in market, because this is a serious business and not done using some home grown utility. Having said that, I agree will Bill on this, as you talk about account numbers, garble-the-data is what you need.

Just my .02$...

Jose Mateo · Posted: Tue Jul 10, 2012 7:57 pm

Good day to all!

I have a solid background on Encryption/Decryption. First with ATM software and then with HSM (Hardware Security Module), I just finish implementing PCI standard at the bank where I work at. One thing I could tell you is that encryption/decryption is not a easy task first of all, if you decide to encrypt the account number then you need to modify all the programs that reference the account number plus the account number will not be displayable unless you decrypt it back to displayable format. IBM has callable encryption/decryption module which you could use. Now if you want to make it simple and just mask the account number using a masking table then all you will do is use the account digit as a subcript to the masking table replacing the account digit with the offset digit of the masking table. Now I will let you decide and think of the rest of the process. Good luck!!

enrico-sorichetti · Posted: Tue Jul 10, 2012 8:39 pm

murugan_mf · Posted: Wed Jul 11, 2012 9:59 am

Thank you all for your valuable comments.