A runtime, architecture, and libraries for Microsoft Windows used for creating applications.

learn more… | top users | synonyms (1)

3
votes
1answer
2k views

Is PBKDF2 only SHA1 in C#?

I can't find a way of specifying the hashing algorithm used by the PBKDF2 (the Rfc2898DeriveBytes class) implementation in C# System.Security.Cryptography. It seems to be just SHA1. Am I missing ...
6
votes
2answers
794 views

Production ready bcrypt implementation for .NET

Which, if any, .NET / C# bcrypt implementations are considered suitable for production environments? I have seen CryptSharp and BCrypt.Net mentioned in answers to other questions but without any ...
2
votes
0answers
62 views

Using GPG or PGP for symmetric database encryption/decryption in c# [duplicate]

Possible Duplicate: Using GPG or PGP for symmetric database encryption/decryption in c# I am looking to symmetrically encrypt/decrypt information in a database. This info consists of short ...
3
votes
1answer
727 views

Using GPG or PGP for symmetric database encryption/decryption in c#

I am looking to symmetrically encrypt/decrypt information in a database. This info consists of short pieces of information, which need to be individually encrypted when a specific method is called. I ...
3
votes
3answers
1k views

Securing AES 128 encrypted ZIPs against brute force attacks

How long would it take to brute force decrypt an AES 128 encrypted zip file if the password is 8 characters long in the range of A-Z, a-z, 1-9? Does it make any difference if .NET's System.Random ...
2
votes
2answers
134 views

Why would encrypting data result in a call to a Domain Controller

This KB article mentions an issue where signing or encrypting information may result in a network IO call to a Domain Controller. Apparently the RSACryptoServiceProvider's SignData and VerifyData ...
3
votes
1answer
253 views

A simple example for showing the use of Data Execution Prevention (DEP) security feature

I am finding it really hard to figure out why we need a DEP! Microsoft states this about DEP: The primary benefit of DEP is to help prevent code execution from data pages. Typically, code ...
4
votes
2answers
218 views

How do I remove or anonymize file names and path that are stored in compiled .NET exe output?

When an exception occurs in a .NET application, the exception output also includes the path and file name of the code file that resided on the developer's machine. This shares some information that ...
1
vote
1answer
151 views

What does a IT Security Pro need to know about .NET Code Access Security (CAS)?

Background In .NET 1.0 through 3.5 administrators could administer the runtime security policy through mscorcfg. Aparrently many of these security features have been removed in .NET 4.0,. ...
5
votes
1answer
118 views

Does every security patch get back ported to every .NET framework? Are there exceptions to the rule?

I can imagine a scenario where Microsoft will create a security patch for some versions of .NET and not others. This might occur in occasions it's too expensive to regression test and back port all ...
1
vote
1answer
850 views

How do I sanitize LDAP input and prevent injection attacks? What LDAP injection scenarios are possible?

In the following C# example I'm querying AD's configuration container for Exchange overrides. If the domain name in unsanitised the end user could get LDAP to read a different object then intended. ...
4
votes
2answers
307 views

Is it a security risk to maintain an application developed for a version of .NET prior to 4.0?

I've had a request that we upgrade all our internally developed applications to .NET v4.0. Needless to say, this is a massive chunk of work. Is using applications based on the .NET framework prior to ...
4
votes
1answer
2k views

What's the risk of changing permissions of the Security Eventlog registry key to IT operations?

Background Many developers are unnecessarily lowering the security of the event log, or requiring applications to run in Administrator mode just so they can use the event log with this C# or VB code: ...
0
votes
1answer
609 views

When should one use RSACryptoServiceProvider vs AESCryptoServiceProvider

I am interested in storing certificates for various purposes on a SmartCard. Since this answer illustrates how there are confusing differences and similarities between RSA and AES When should one ...
2
votes
2answers
248 views

Are GUID visible when compiling a .NET project?

I know if a person has a GUID from a machine that person can figure out if other guid belongs to that machine. In a .NET project (csproj and the visual studions solution file) GUIDs are generated. If ...
3
votes
1answer
940 views

Encrypt Medicare card numer in C# in ASP.NET

I am giving a free consultation for a non profit organisation that wants a simple system to manage multiple groups with a schedule component, etc. and also manage the medical informations of the kids. ...
2
votes
3answers
718 views

How to do a virus scan before post attachments in asp.net application

How to do a virus scan before post attachments in asp.net application,when they find a virus on to give up post attachments,otherwise proceed to upload. I wonder if there are any APIs out there where ...
8
votes
4answers
592 views

Is it safe to binary-deserialize user-provided data?

AppHarbor has a blog post containing sample C# code which reads data from an unsigned cookie and passes it through .Net binary serialization. Is that safe? Obviously, the data is completely ...
2
votes
2answers
1k views

Secure communication between C# client and Java server, using certificates

I want to secure communication between simple C# WPF client and Java server. Now i have already implemented raw sockets communication, and my security is based on: server send RSA public key to ...
3
votes
1answer
657 views

How to use DPAPI under load balance environment

DPAPI can be used to encrypt the secret data. We intend to use it in our web app to encrypt some data and store the encrypted data in database. When needed we decrypt the data and present them on ...
4
votes
2answers
1k views

How to store IV and key temporarily but securely

I am using .NET 4.0 to develop a Windows service that will temporarily store encrypted data in a database. The data will be encrypted when it is inserted, then decrypted, processed, and deleted once ...
6
votes
2answers
2k views

C# Image.FromStream is that secure?

after reading the data from the request as Stream i needed to convert it to Image so i used this Method: Stream inputStream = HttpContext.Current.Request.InputStream; Image img = ...
3
votes
1answer
302 views

Does strong naming remove the need for packing/obfuscation?

I'm new to .NET programming, and I'm wondering - from a security perspective - whether the strong naming scheme used in .NET assemblies completely removes the need for other commonly used techniques ...
4
votes
4answers
4k views

Reflector - obfuscated code

I run Reflector to de-compile some program and it seems to be obfuscated. I got following output, it’s not very useful. Any ideas how to decompile obfuscated code? [CompilerGenerated] get ...
2
votes
1answer
587 views

Are .NET WebServices vulnerable to CSRF?

While developing TeamMentor I implemented a number of WebServices (consumed via jQuery) and now on its final push for release I want to double check that they are not vulnerable to CSRF. There isn't ...
0
votes
1answer
1k views

windows security alert windows firewall has blocked some features of this program message coming for every new build of my application

I made an application which uses ftp so windows shows windows security alert windows firewall has blocked some features of this program message for every new version of my application any idea how to ...
2
votes
3answers
368 views

What are the best security practices to install a C# Web App on client servers?

We would like to install a Web App written in C#/.NET4 on client servers, not ours. I would like to know what are the best security practices to implement for avoid the following: Authority ...
2
votes
1answer
99 views

Using MySQL in .NET and other easily-decompiled languages?

How would people use MySQL in C#, or really any other managed application? Couldn't someone simply decompile the application and find out the password/etc. for the database?
2
votes
3answers
128 views

Identifying and preventing execution of “any” function via Late-Bound commands

The Command Pattern is widely used to create a robust, salable applications. However I see guidance in this MSDN article that could allow a caller to invoke a late-bound command... enabling the ...
2
votes
2answers
718 views

C# Encrypting string in DES 3 CBC mode

Is it normal that when I use Double DES secret key to encrypt a string in DES3 CBC mode then I always get the same cipher text? For testing I'm using IVC=0.
3
votes
3answers
946 views

AES for key encryption

Is AES a good choice for protecting a key stored on the computer of a user of my application? I have seen threads on hashing passwords that suggest using slow algorithms for defending against brute ...
11
votes
4answers
1k views

Using computer random number generators to produce keys, it is secure?

Does generating an encryption key using the random number generator on one's computer present a security risk? If so how might that risk be mitigated, specifically when generating RSA key pairs in ...
8
votes
4answers
2k views

What Partial Homomorphic Encryption implementations exist and how do I leverage them?

It appears that only Partial Homomorphic Encryption(P.H.E.) is practical for modern day (2011) use. However I'm having difficulty locating libraries (FOSS or otherwise) that enable me to leverage ...
3
votes
1answer
700 views

Peer review of C# cryptography for Azure Table security

Edit: Update - I am researching how to implement AES with authentication in an efficient way for this project. If you have the time I'd appreciate your skill in finding the best implementation for ...
4
votes
2answers
4k views

Diffie Hellman c# implementation

Hallo all, For a test project I have tried to implement the (famous) Diffie Hellman algorithm for safe key exchange. Now I have written this in C#: using System; using System.Collections; using ...
9
votes
2answers
2k views

Data Encryption and Key Management in C#

Which route to take, what are the pros and cons, which is more secure.. Generate AES key, encrypt the data with it and then encrypt the AES key with RSA, save the encrypted data and encrypted AES ...
2
votes
2answers
349 views

What is the correct way to assess and compare Certicom's products to the alternatives?

I'm investigating Certicom's API because they are "free" with the Blackberry implementations, and have come to realize that I have several alternatives for implementing crypto such as BouncyCastle, ...
5
votes
2answers
2k views

Reference implementation of C# password hashing and verification

Does anyone have a reference implementation (ideally 3rd party certified, or government approved) way one-way hash a password for C# and or Java? Ideally,I'd like to see something that includes a ...
12
votes
6answers
6k views

Is PBKDF2-based System.Cryptology.RFC2898DeriveBytes() “better” for Unicode Password hashing than traditional methods?

When is it appropriate to use RFC2898DeriveBytes versus a typical hash? Update I now understand that a KDF is typically used to create a symmetric key for possible use in encrypting a stream. I ...
4
votes
1answer
89 views

Does the compiler feature of Closures decrease member variable security?

Based on this discussion, closures in C# promote private variables to public variables at compile time. Suppose a closure was implemented on a Username or Password string. Would there be any ...
4
votes
1answer
178 views

When does one need to be concerned with leaking timing information in .NET?

According to this post, Dominick Baier was comparing two HMACSHA256 signatures and was leaking timing information upon an unsuccessful comparison. When working with .NET crypto classes, when should ...
4
votes
1answer
634 views

Why does Bouncy Castle have a separate download for the IDEA algorithm?

I'm looking at downloading the C# binary for Bouncy Castle and see two downloads with source code. One has the IDEA algorithm, the others presumably not. http://www.bouncycastle.org/csharp/ Why ...
13
votes
7answers
5k views

What are the realistic, and most secure crypto for Symmetric, Asymmetric, Hash, Message Authentication Code ciphers?

I'm interested in updating this two pronged question for 2011: What cryptology is most appropriate for low-powered devices (such as a cellphone), and yet still effective? What cryptology is most ...
3
votes
1answer
2k views

How do I use C# to encrypt/decrypt data where the private key is on a smartcard, hardware security module, TPM chip etc

Is anyone aware of a C# code sample to interact with smartcard, hardware security module, TPM chips (etc), that will allow me to encrypt and decrypt data? My goal is to allow my application to ...
1
vote
1answer
612 views

Tutorial for SecurityCritical SecurityTransparent and new .NET 4 feature: Level 2

I need a primer for both the legacy (Level 1) .NET 2.0 security attributes and the new .NET 4 (Level 2) ones. I'm not familiar with the implications of controlling LinkDemand, stack walks, ...
4
votes
1answer
249 views

Anyone use the International Domain Name (IDN) security mitigation API's? Is there a wrapper for .NET?

The International Domain Name mitigation API's are available here for download: http://www.microsoft.com/downloads/en/details.aspx?FamilyID=ad6158d7-ddba-416a-9109-07607425a815&displaylang=en ...