C# Cryptography generating a key

Question

I am trying to encrypt/decrypt a string using c#. I've found countless tutorials on how to this ex: this However most of them assume you already have the key. So my question is:

How do I generate the key ?

Thanks in advance.

You could ask the user for a pass phase – Ignacio Soler Garcia Dec 21 '11 at 10:01 — Ignacio Soler Garcia, Dec 21 '11 at 10:01

anton.burger · Accepted Answer · 2011-12-21T11:59:24.727

4

If you're using the encryption classes in the System.Security.Cryptography namespace, use the Rfc2898DeriveBytes class (@CodeInChaos points out that it supersedes PasswordDeriveBytes) to derive a key from a password.

If a random key is OK, the SymmetricAlgorithm class has a GenerateKey method.

edited Dec 21 '11 at 11:59

answered Dec 21 '11 at 10:17

anton.burger

5,637
32
48

I'd favour `Rfc2898DeriveBytes` http://msdn.microsoft.com/en-us/library/system.security.cryptography.rfc2898derivebytes.aspx – CodesInChaos Dec 21 '11 at 10:38
@CodeInChaos, what's the TL;DR version of why you'd choose one over the other? – anton.burger Dec 21 '11 at 11:14
`Rfc2898DeriveBytes` is PBKDF2, `PasswordDeriveBytes` is PBKDF1. And I simply assume 2 is better than 1. – CodesInChaos Dec 21 '11 at 11:36
Fair enough; I looked into it a little more and decided to update the answer after seeing more references to the newer standard. – anton.burger Dec 21 '11 at 12:00
2

There are very good reasons to avoid PBKDF1 and even more how Microsoft implement (extended it) in `PasswordDeriveBytes`, see: http://stackoverflow.com/a/8459312/220643 – poupou Dec 21 '11 at 13:37
@poupou Thanks for elaborating on that; very handy to know. – anton.burger Dec 21 '11 at 14:44

vstm · Answer 2 · 2011-12-21T15:28:49.350

It depends on you handle the keys.

If you automatically generate the key and just exchange the key over some channel with a key-exchange method then you should generate the key with some strong random number generator like RNGCryptoServiceProvider. Actually most Ciphers in .NET generate a random key automatically.

If you want to have some kind of user entered password then I suggest you to use the Rfc2898DeriveBytes class. There is also a Tutorial on the .NET Security blog about Rfc2898DeriveBytes.

score 1 · Answer 3 · answered Dec 21 '11 at 10:14

1

Well depending on what key you want you can generate one here

http://randomkeygen.com/ or https://www.grc.com/passwords.htm

But what type of key are you after?

answered Dec 21 '11 at 10:14

Adam

16,089
6
66
109

C# Cryptography generating a key

3 Answers3