4
votes
2answers
2k views

How to store IV and key temporarily but securely

I am using .NET 4.0 to develop a Windows service that will temporarily store encrypted data in a database. The data will be encrypted when it is inserted, then decrypted, processed, and deleted once ...
4
votes
4answers
5k views

Reflector - obfuscated code

I run Reflector to de-compile some program and it seems to be obfuscated. I got following output, it’s not very useful. Any ideas how to decompile obfuscated code? [CompilerGenerated] get ...
2
votes
3answers
147 views

Identifying and preventing execution of “any” function via Late-Bound commands

The Command Pattern is widely used to create a robust, salable applications. However I see guidance in this MSDN article that could allow a caller to invoke a late-bound command... enabling the ...
3
votes
3answers
1k views

AES for key encryption

Is AES a good choice for protecting a key stored on the computer of a user of my application? I have seen threads on hashing passwords that suggest using slow algorithms for defending against brute ...
4
votes
1answer
90 views

Does the compiler feature of Closures decrease member variable security?

Based on this discussion, closures in C# promote private variables to public variables at compile time. Suppose a closure was implemented on a Username or Password string. Would there be any ...
4
votes
1answer
190 views

When does one need to be concerned with leaking timing information in .NET?

According to this post, Dominick Baier was comparing two HMACSHA256 signatures and was leaking timing information upon an unsuccessful comparison. When working with .NET crypto classes, when should ...
4
votes
1answer
675 views

Why does Bouncy Castle have a separate download for the IDEA algorithm?

I'm looking at downloading the C# binary for Bouncy Castle and see two downloads with source code. One has the IDEA algorithm, the others presumably not. http://www.bouncycastle.org/csharp/ Why ...
3
votes
1answer
3k views

How do I use C# to encrypt/decrypt data where the private key is on a smartcard, hardware security module, TPM chip etc

Is anyone aware of a C# code sample to interact with smartcard, hardware security module, TPM chips (etc), that will allow me to encrypt and decrypt data? My goal is to allow my application to ...
1
vote
1answer
657 views

Tutorial for SecurityCritical SecurityTransparent and new .NET 4 feature: Level 2

I need a primer for both the legacy (Level 1) .NET 2.0 security attributes and the new .NET 4 (Level 2) ones. I'm not familiar with the implications of controlling LinkDemand, stack walks, ...
4
votes
1answer
261 views

Anyone use the International Domain Name (IDN) security mitigation API's? Is there a wrapper for .NET?

The International Domain Name mitigation API's are available here for download: http://www.microsoft.com/downloads/en/details.aspx?FamilyID=ad6158d7-ddba-416a-9109-07607425a815&displaylang=en ...