What encryption method (algorithm) is used to password protect MS Access 2003 database?
My application uses MS access database to keep confidential information. While this information is itself protected, I need to convince the client that there is another wall of database encryption with a strong password that needs to be broken first.
Do you know which encryption algorithm / method is used to encrypt the access database?
a source to share
Several encryption options exist for Access 2003 . Some of the possible encryption types that you can find in the Encryption Type dialog box are:
- Weak encryption (XOR)
Not recommended, only for obsolete files - Office 97/2000 Compatibility
Not recommended, only for legacy files - RC4, Microsoft Base Cryptographic Provider v1.0
- RC4, Microsoft Base DSS and Diffie-Hellman Cryptographic Provider.
- RC4, Microsoft DH SChannel Cryptographic Provider.
- RC4, Microsoft Enhanced Cryptographic Provider v1.0
- RC4, Microsoft Enhanced DSS, and Diffie-Hellman Cryptographic Provider.
- RC4, Microsoft Enhanced RSA, and AES Cryptographic Provider (Prototype)
- RC4, Microsoft RSA SChannel Cryptographic Provider
- RC4, Microsoft Strong Cryptographic Provider
Source: Important Aspects of Password Protection and Encryption
If you are using Access 2007, here is a good article that you can use as a reference:
What type of encryption does Access 2007 use?
Access 2007 uses the Microsoft Cryptographic API. This means that it will support any cryptographic algorithm available in Windows as a cryptographic service provider (CSP). This is a big improvement on earlier versions of Access, and only the built-in, weak encryption algorithm is supported.
a source to share
I need to convince the client that there is another encryption database wall with a strong password that needs to be broken first.
I don't think you can because the password protection is weak. So that...
that the information itself is protected
... how you yourself protected the information (encryption?) may be your only line of defense.
Also, consider upgrading to Access2007, which has stronger database encryption (although user-level security has been removed).
EDIT: I am still looking for the Holy Grail which is the documentation for the Jet engine. One great thing about the changes made to the Access2007 engine is that the Access team found a few details about the old engine, in the context of "new is better than old because ..." No wonder they don't publicly announce that encryption was weak until they fixed it! You will find a few details in the Microsoft Access Team Blog: Access 12 Security Model .
Another link: Microsoft Access 2002 Technical Articles: Examining Microsoft Access Security "Jet (the database engine used by Access) uses a very weak encryption method and should never be used to protect sensitive data."
Last: Jet MDB Security - Under the Hood Simple Database Password: The database password on installation is obfuscated by a simple XOR pattern algorithm based on the file creation date / time (stored inside the file), which is then stored in the MDB file header .... itself the MDB file header is additionally confused with the XOR pattern - although this time it's a constant stream of XOR. (I describe these XOR encryption algorithms as obfuscation rather than encryption given how simple they are.) When you open your MDB file, you are prompted for a password, and then Jet can easily decode the original password to check if it matches the entered password.
Pros Easy to customize.
Cons The password is easily recovered as it is effectively stored in plain text (very simple obfuscation).
a source to share