A runtime, architecture, and libraries for Microsoft Windows used for creating applications.
2
votes
3answers
782 views
AES for key encryption
Is AES a good choice for protecting a key stored on the computer of a user of my application? I have seen threads on hashing passwords that suggest using slow algorithms for defending against brute ...
10
votes
4answers
945 views
Using computer random number generators to produce keys, it is secure?
Does generating an encryption key using the random number generator on one's computer present a security risk? If so how might that risk be mitigated, specifically when generating RSA key pairs in ...
7
votes
4answers
1k views
What Partial Homomorphic Encryption implementations exist and how do I leverage them?
It appears that only Partial Homomorphic Encryption(P.H.E.) is practical for modern day (2011) use. However I'm having difficulty locating libraries (FOSS or otherwise) that enable me to leverage ...
3
votes
1answer
576 views
Peer review of C# cryptography for Azure Table security
Edit: Update - I am researching how to implement AES with authentication in an efficient way for this project. If you have the time I'd appreciate your skill in finding the best implementation for ...
4
votes
2answers
3k views
Diffie Hellman c# implementation
Hallo all,
For a test project I have tried to implement the (famous) Diffie Hellman algorithm for safe key exchange.
Now I have written this in C#:
using System;
using System.Collections;
using ...
7
votes
2answers
1k views
Data Encryption and Key Management in C#
Which route to take, what are the pros and cons, which is more secure..
Generate AES key, encrypt the data with it and then encrypt the AES key with RSA, save the encrypted data and encrypted AES ...
2
votes
2answers
296 views
What is the correct way to assess and compare Certicom's products to the alternatives?
I'm investigating Certicom's API because they are "free" with the Blackberry implementations, and have come to realize that I have several alternatives for implementing crypto such as BouncyCastle, ...
68
votes
20answers
16k views
Lessons learned and misconceptions regarding encryption and cryptology
Cryptology is such a broad subject that even experienced coders will almost always make mistakes the first few times around. However encryption is such an important topic, often we can't afford to ...
4
votes
2answers
1k views
Reference implementation of C# password hashing and verification
Does anyone have a reference implementation (ideally 3rd party certified, or government approved) way one-way hash a password for C# and or Java?
Ideally,I'd like to see something that includes a ...
10
votes
6answers
5k views
Is PBKDF2-based System.Cryptology.RFC2898DeriveBytes() “better” for Unicode Password hashing than traditional methods?
When is it appropriate to use RFC2898DeriveBytes versus a typical hash?
Update
I now understand that a KDF is typically used to create a symmetric key for possible use in encrypting a stream. I ...
4
votes
1answer
86 views
Does the compiler feature of Closures decrease member variable security?
Based on this discussion, closures in C# promote private variables to public variables at compile time.
Suppose a closure was implemented on a Username or Password string. Would there be any ...
3
votes
1answer
153 views
When does one need to be concerned with leaking timing information in .NET?
According to this post, Dominick Baier was comparing two HMACSHA256 signatures and was leaking timing information upon an unsuccessful comparison.
When working with .NET crypto classes, when should ...
4
votes
1answer
504 views
Why does Bouncy Castle have a separate download for the IDEA algorithm?
I'm looking at downloading the C# binary for Bouncy Castle and see two downloads with source code. One has the IDEA algorithm, the others presumably not.
http://www.bouncycastle.org/csharp/
Why ...
10
votes
7answers
3k views
What are the realistic, and most secure crypto for Symmetric, Asymmetric, Hash, Message Authentication Code ciphers?
I'm interested in updating this two pronged question for 2011:
What cryptology is most appropriate for low-powered devices (such as a cellphone), and yet still effective?
What cryptology is most ...
3
votes
1answer
2k views
How do I use C# to encrypt/decrypt data where the private key is on a smartcard, hardware security module, TPM chip etc
Is anyone aware of a C# code sample to interact with smartcard, hardware security module, TPM chips (etc), that will allow me to encrypt and decrypt data?
My goal is to allow my application to ...
1
vote
1answer
433 views
Tutorial for SecurityCritical SecurityTransparent and new .NET 4 feature: Level 2
I need a primer for both the legacy (Level 1) .NET 2.0 security attributes and the new .NET 4 (Level 2) ones.
I'm not familiar with the implications of controlling LinkDemand, stack walks, ...
4
votes
1answer
197 views
Anyone use the International Domain Name (IDN) security mitigation API's? Is there a wrapper for .NET?
The International Domain Name mitigation API's are available here for download:
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=ad6158d7-ddba-416a-9109-07607425a815&displaylang=en
...
