Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am interested in storing certificates for various purposes on a SmartCard. Since this answer illustrates how there are confusing differences and similarities between RSA and AES

When should one class be used over the other to get the most interoperability? If the class doesn't matter so much as the settings, what settings are most appropriate.

My intent is to understand which API (and corresponding settings) is best used cross platform, and across API (Java, 3rd party). I would have posted this on the Crypto forum, but that appears to be more about theory and less about coding.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

This is the only relevant part:

" RijndaelManaged class is a kind of implementation of Rijndael algorithm in .net framework, which was not validated under NIST (National Institute of Standards and Technology) Cryptographic Module Validation Program (CMVP).
However, AesCryptoServiceProvider class calls the Windows Crypto API, which uses RSAENH.DLL, and has been validated by NIST in CMVP. "

You should use the one that met the NIST specifications. Else there is no way to prove that the RSA algorithm is as secure as you think it is, or if it is compatible with other RSA implementations.

share|improve this answer
    
Thank you. I kinda assumed this was the answer, but see many people recommend RSA crypto provider by mistake, and not the AES. I suppose really only "asked" the question because I want people aware of the similarities, and differences between the two providers. –  makerofthings7 Jun 4 '12 at 18:37
    
@makerofthings7 It isn't to say RSA is flawed, it is the implementation that is within the .NET framework that is a problem. Ideally this is highlighted in the .NET documentation and has a compiler warning as well. –  Woot4Moo Jun 4 '12 at 19:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.