Encrypting R Script Under Ms-Windows

Is it possible to compile R scripts into a binary?

Found this: I'm not sure about the security, but this is definitely a deterrent and would take (I think) some fairly concentrated effort to crack. There is a byte code compiler for R based on the paper linked below. There is a method in library(compiler), which comes standard with R, that allows you to compile an R script to byte code. In the same library, you can load in the source files and use them as you'd like.

A Byte Code Compiler for R

Safely use passwords in R files - prevent them to be stored as plain text

One solution is to use the keyringr package and use it as following. I adapted the Howto on the CRAN page.
This is the solution for a Windows machine. First of all one has to create a small powershell script PasswordEncryption.ps1:

# Create directory user profile if it doesn't already exist.
$passwordDir = "DPAPI\passwords\$($env:computername)"
New-Item -ItemType Directory -Force -Path $passwordDir

# Prompt for password to encrypt
$account = Read-Host "Please enter a label for the text to encrypt.  This will be how you refer to the password in R.  eg. MYDB_MYUSER"
$SecurePassword = Read-Host -AsSecureString  "Enter password" | convertfrom-securestring | out-file "$($passwordDir)\$($account).txt"

# Check output and press any key to exit
Write-Host "Press any key to continue..."
$x = $host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")

After the execution of this script and the entering of the label and the password one now can use the encrypted password in R.

library(keyringr)
credential_label <- "MYDB_MYUSER"
credential_path <- paste( getwd(),'\\DPAPI\\passwords\\', Sys.info()["nodename"], '\\', credential_label, '.txt', sep="")
my_pwd <- decrypt_dpapi_pw(credential_path)
print(my_pwd)

Or better just add the call to decrypt the password directly to the ODBC command and don't store it in the R environment.

library(DBI)
rodbc <- DBI::dbConnect(RODBCDBI::ODBC()
                   , dsn = "DSN0123"
                   , user = "user"
                   , password = decrypt_dpapi_pw(credential_path))

Edit: An alternative, when using rstudio is to use the rstudioapi, like this:

rodbc <- DBI::dbConnect(RODBCDBI::ODBC()
                   , dsn = "DSN0123"
                   , user = rstudioapi::askForPassword("Database user")
                   , password = rstudioapi::askForPassword("Database password")

Sharing R functionality with multiple users without exposing code

One option would be to expose your functions as services using something like Rserve. That would, however, require that you host the server running the code for your users.

How to use OpenSSL to encrypt/decrypt files?

Security Warning: AES-256-CBC does not provide authenticated encryption and is vulnerable to padding oracle attacks. You should use something like age instead.

Encrypt:

openssl aes-256-cbc -a -salt -pbkdf2 -in secrets.txt -out secrets.txt.enc

Decrypt:

openssl aes-256-cbc -d -a -pbkdf2 -in secrets.txt.enc -out secrets.txt.new

More details on the various flags

---

Related Topics