0

I have the following code to encrypt and decrypt data using the RijndaelManaged in .NET.

public string EncryptString(string ClearText)
{
    byte[] clearTextBytes = Encoding.UTF8.GetBytes(ClearText);
    SymmetricAlgorithm rijn = SymmetricAlgorithm.Create();

    MemoryStream ms = new MemoryStream();
    byte[] rgbIV = Encoding.ASCII.GetBytes("xhxqtbaoxhvchptd");
    byte[] key = Encoding.ASCII.GetBytes("ajyvccpeycjeauyncgdiohssyvusdknj");

    CryptoStream cs = new CryptoStream(ms, rijn.CreateEncryptor(key, rgbIV), CryptoStreamMode.Write);
    cs.Write(clearTextBytes, 0, clearTextBytes.Length);
    cs.Close();

    return Convert.ToBase64String(ms.ToArray());
}

public string DecryptString(string EncryptedText)
{
    byte[] encryptedTextBytes = Convert.FromBase64String(EncryptedText);
    SymmetricAlgorithm rijn = SymmetricAlgorithm.Create();

    MemoryStream ms = new MemoryStream();
    byte[] rgbIV = Encoding.ASCII.GetBytes("xhxqtbaoxhvchptd");
    byte[] key = Encoding.ASCII.GetBytes("ajyvccpeycjeauyncgdiohssyvusdknj");

    CryptoStream cs = new CryptoStream(ms, rijn.CreateDecryptor(key, rgbIV), CryptoStreamMode.Write);
    cs.Write(encryptedTextBytes, 0, encryptedTextBytes.Length);
    cs.Close();

    return Encoding.UTF8.GetString(ms.ToArray());
}

I have two questions:

1) I know that the practice of keeping the keys in the source code is not good as someone who can read the source code can get the keys. Are there some best practices about where and how to store the keys?

2) Is the code above secure enough to be deployed in a production environment, keeping in mind that the keys are stored securely?

Matthew
  • 4,477
  • 21
  • 70
  • 93
  • Without some more context on what you're trying to secure it's difficult to tell if this is "secure enough" or not. – dtb Apr 18 '13 at 17:26
  • This code is going to be used on a server. In a typical scenario, the server is in a secure location and can only be accessed through proper authroization. The project is not going to be sent to anyone. – Matthew Apr 18 '13 at 17:28
  • IV should be different for each encryption and stored alongside the the ciphertext. It is not a secondary key. – CodesInChaos Apr 18 '13 at 19:26

0 Answers0