Quantcast
Channel: User aggsol - Stack Overflow
Viewing all articles
Browse latest Browse all 44

Why is crypto with .Net Framework so complicated?

$
0
0

In most cases I need to encrypt a string with a password and then send/save it somewhere. Later I want do decrypt it with the password. I am not encrypting nuclear missile codes or medical patient data! The ideal would be 2 functions:

string Encrypt(string plainText, string password);string Decrypt(string cipherText, string password);

I had a look at the crypto documentation... Oh boy! So I try to code the above calls myself (see a proof of concept using AES Managed and Base64 encoded payload). I am no crypto expert, why do I have to code that? I probably did somethings wrong...

  1. To derive the key from the password the interface requires a salt. Can I use the password as salt? Can I re-use the IV as salt? Maybe not, but I don't want to add another parameter.
  2. Can I use a fixed IV? Same plaintext and password should result in different cipher text, so I have to supply the IV for decryption in the payload.
  3. Can I use a salt for the key and keep the IV constant instead? Feels wrong.
  4. Creating a nonce and deriving IV and key salt from it is a valid approach?
  5. If .Net would support the GCM mode would I still have this problems?

Viewing all articles
Browse latest Browse all 44

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>