A runtime, architecture, and libraries for Microsoft Windows used for creating applications.
-2
votes
0answers
55 views
Which encoding/decoding is used? [closed]
In an application following encoded data is stored in database.
**Original Number/Character -> Encoded data**
33 --> +FzSFp7OKpU=
39 --> ...
7
votes
2answers
1k views
Data Encryption and Key Management in C#
Which route to take, what are the pros and cons, which is more secure..
Generate AES key, encrypt the data with it and then encrypt the AES key with RSA, save the encrypted data and encrypted AES ...
2
votes
2answers
100 views
Why would encrypting data result in a call to a Domain Controller
This KB article mentions an issue where signing or encrypting information may result in a network IO call to a Domain Controller.
Apparently the RSACryptoServiceProvider's SignData and VerifyData ...
2
votes
1answer
76 views
How to Verify the Identity of the Caller of a Web Service
I have a server which is composed of a page and a web service. The web service is intended to be used by a Windows Phone mobile application that I will develop myself.
Now, my question is, how do I ...
7
votes
1answer
325 views
A practical .NET Remoting Architecture exploit
If you were to demonstrate a .NET Remoting Architecture vulnerability with a practical attack, which one would you choose?
I've read J. Forshaw's white paper on Breaking .NET Through Serialization ...
-7
votes
1answer
82 views
Asymmetric encryption algorithms [closed]
What are the best asymmetric encryption algorithms out there? I am trying to use RSA in my project howoever I have read that it is not quite secure as other asymmetric encryption algorithms.
2
votes
1answer
45 views
How does a function certificate work?
Say that we have a client / server solution (written in .NET). If we want to use a certificate for the TCP communication, is it enough to use one function/service certificate to encrypt communication ...
1
vote
0answers
65 views
OTR and/or SecureIM library for C# .NET [closed]
I'm looking for implementations (or even wrappers) for OTR or SecureIM encrypted chat protocols usable from C#.
Currently I found none, and considering porting Java OTR library and/or wrapping ...
1
vote
2answers
289 views
Questions to hybrid encryption. RSA with AES
I want to use a hybrid encryption in my application, so after reading a lot of lines I ended with this implemantation, please critizie it ;) (I want to stick to .Net)
byte[] aesKey = ...
7
votes
4answers
1k views
What Partial Homomorphic Encryption implementations exist and how do I leverage them?
It appears that only Partial Homomorphic Encryption(P.H.E.) is practical for modern day (2011) use. However I'm having difficulty locating libraries (FOSS or otherwise) that enable me to leverage ...
5
votes
3answers
226 views
Why must all classes' data members be set to private?
In OO programming courses, teachers always tells us to set class members to private unless there is a good reason because it is more "secured".
How does setting members to private makes the program ...
0
votes
0answers
58 views
Best strategy using encryption to ensure that only authorized application can access smartcard? [closed]
I want to encrypt the data in smart card to ensure the safety of the data so no unauthorized application could access these data, any suggestion about good mechanism to do that? what is the best ...
1
vote
2answers
72 views
How do I sanitize and check large numbers that will be sent to an unmanaged BigNum library like GMP?
I need to process data that is sent by users in a LargeNumber format. My current choices are
BigInteger (.Net Managed Code)
IntX (Managed Code, faster for some operations)
GMP / MPIR (Unmanaged ...
1
vote
2answers
129 views
How to check whether the cookie is set securely
I found solution for setting asp.net_sessionid cookie as secure.
The solution is to make changes in web.config file as given below.
<\system.web>
I want to know if this change is setting the ...
6
votes
2answers
390 views
Production ready bcrypt implementation for .NET
Which, if any, .NET / C# bcrypt implementations are considered suitable for production environments?
I have seen CryptSharp and BCrypt.Net mentioned in answers to other questions but without any ...
4
votes
2answers
212 views
How to correctly implement AES in a backup application
I am writing a back-up application which should have the feature of encrypting the back-up. It must encrypt file data, paths and filenames. The application is being written in C# (.NET). Target is ...
1
vote
2answers
265 views
UNION SQL Injection
I'm trying to demo SQL Injection with a UNION query but I'm not getting results.
This is the C# code and the database is SQL Server 2008 R2:
string cString = "server=.\\sqlexpress; ...
1
vote
1answer
219 views
Setting up ASP.NET web application on internet for first time; Are these security measures enough?
I have a web application running on IIS 7 in offices on LAN and I wish to upload it to hosting space on (Godaddy) because I like it to be used in my other offices (other cities).
This application ...
5
votes
4answers
484 views
Gold Standard for password hashing
I've developing a web application that will be dealing with highly sensitive information and I want to ensure the hashing of passwords is gold standard. Ideally I'd go for per-user salted SHA512 ...
6
votes
1answer
395 views
Secure query string parameters
I have an application which use the Thick box jQuery component to open a popup page .
And I pass my parameters in query string like this :
<a id="btnShowPopup6" runat="server" class="thickbox" ...
2
votes
1answer
205 views
Are there any functional differences in the implementations of OpenSSL, GnuTLS, Java's TLS, and .NET's TLS?
Question
Are there any functional (or detectable) differences between the various implementations of SSL/TLS? What are the differences between them? (e.g. which ones implement "False Start")
...
2
votes
2answers
197 views
Are GUID visible when compiling a .NET project?
I know if a person has a GUID from a machine that person can figure out if other guid belongs to that machine.
In a .NET project (csproj and the visual studions solution file) GUIDs are generated. If ...
9
votes
3answers
735 views
How can I encrypt a file with .NET and have the same file size of the original file?
I'm using .NET and I've written an awesome routine (xD) that encrypts and decrypts a file using AES256 CBC. It works perfectly, but now they told me that the encrypted file must be of the same size of ...
5
votes
1answer
479 views
“Hello World” example of a Buffer Overflow attack in many programming languages
I'm looking for a very simple application that has an intentional Buffer Overflow embedded in it. I'm assuming this possible in systems where DEP and ASLR are not being used
Ideally (and if ...
2
votes
3answers
523 views
How to do a virus scan before post attachments in asp.net application
How to do a virus scan before post attachments in asp.net application,when they find a virus on to give up post attachments,otherwise proceed to upload.
I wonder if there are any APIs out there where ...
1
vote
4answers
988 views
What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase
(Note: originally posted in SO - advised to post on SSE)
With regards to Rijndael encryption, what (if any) are the best practices (and consequences) regarding the periodic modification of one or ...
2
votes
1answer
1k views
Is PBKDF2 only SHA1 in C#?
I can't find a way of specifying the hashing algorithm used by the PBKDF2 (the Rfc2898DeriveBytes class) implementation in C# System.Security.Cryptography.
It seems to be just SHA1. Am I missing ...
4
votes
2answers
495 views
How should an application store its credentials
When developing desktop applications, you will occasionally have to store credentials somewhere to be able to authenticate your application. An example of this is a Facebook app ID + secret, another ...
3
votes
1answer
578 views
Encrypt Medicare card numer in C# in ASP.NET
I am giving a free consultation for a non profit organisation that wants a simple system to manage multiple groups with a schedule component, etc. and also manage the medical informations of the kids. ...
2
votes
1answer
93 views
Using MySQL in .NET and other easily-decompiled languages?
How would people use MySQL in C#, or really any other managed application? Couldn't someone simply decompile the application and find out the password/etc. for the database?
1
vote
0answers
57 views
Using GPG or PGP for symmetric database encryption/decryption in c# [duplicate]
Possible Duplicate:
Using GPG or PGP for symmetric database encryption/decryption in c#
I am looking to symmetrically encrypt/decrypt information in a database. This info consists of short ...
2
votes
1answer
429 views
Using GPG or PGP for symmetric database encryption/decryption in c#
I am looking to symmetrically encrypt/decrypt information in a database. This info consists of short pieces of information, which need to be individually encrypted when a specific method is called.
I ...
2
votes
3answers
880 views
Securing AES 128 encrypted ZIPs against brute force attacks
How long would it take to brute force decrypt an AES 128 encrypted zip file if the password is 8 characters long in the range of A-Z, a-z, 1-9?
Does it make any difference if .NET's System.Random ...
1
vote
1answer
166 views
A simple example for showing the use of Data Execution Prevention (DEP) security feature
I am finding it really hard to figure out why we need a DEP!
Microsoft states this about DEP:
The primary benefit of DEP is to help prevent code execution from data
pages.
Typically, code ...
4
votes
2answers
151 views
How do I remove or anonymize file names and path that are stored in compiled .NET exe output?
When an exception occurs in a .NET application, the exception output also includes the path and file name of the code file that resided on the developer's machine. This shares some information that ...
1
vote
1answer
103 views
What does a IT Security Pro need to know about .NET Code Access Security (CAS)?
Background
In .NET 1.0 through 3.5 administrators could administer the runtime security policy through mscorcfg. Aparrently many of these security features have been removed in .NET 4.0,. ...
5
votes
1answer
91 views
Does every security patch get back ported to every .NET framework? Are there exceptions to the rule?
I can imagine a scenario where Microsoft will create a security patch for some versions of .NET and not others. This might occur in occasions it's too expensive to regression test and back port all ...
0
votes
1answer
566 views
How do I sanitize LDAP input and prevent injection attacks? What LDAP injection scenarios are possible?
In the following C# example I'm querying AD's configuration container for Exchange overrides. If the domain name in unsanitised the end user could get LDAP to read a different object then intended.
...
4
votes
2answers
167 views
Is it a security risk to maintain an application developed for a version of .NET prior to 4.0?
I've had a request that we upgrade all our internally developed applications to .NET v4.0.
Needless to say, this is a massive chunk of work. Is using applications based on the .NET framework prior to ...
4
votes
1answer
1k views
What's the risk of changing permissions of the Security Eventlog registry key to IT operations?
Background
Many developers are unnecessarily lowering the security of the event log, or requiring applications to run in Administrator mode just so they can use the event log with this C# or VB code:
...
0
votes
1answer
407 views
When should one use RSACryptoServiceProvider vs AESCryptoServiceProvider
I am interested in storing certificates for various purposes on a SmartCard. Since this answer illustrates how there are confusing differences and similarities between RSA and AES
When should one ...
10
votes
7answers
3k views
What are the realistic, and most secure crypto for Symmetric, Asymmetric, Hash, Message Authentication Code ciphers?
I'm interested in updating this two pronged question for 2011:
What cryptology is most appropriate for low-powered devices (such as a cellphone), and yet still effective?
What cryptology is most ...
6
votes
3answers
328 views
Is it safe to binary-deserialize user-provided data?
AppHarbor has a blog post containing sample C# code which reads data from an unsigned cookie and passes it through .Net binary serialization.
Is that safe?
Obviously, the data is completely ...
10
votes
6answers
5k views
Is PBKDF2-based System.Cryptology.RFC2898DeriveBytes() “better” for Unicode Password hashing than traditional methods?
When is it appropriate to use RFC2898DeriveBytes versus a typical hash?
Update
I now understand that a KDF is typically used to create a symmetric key for possible use in encrypting a stream. I ...
2
votes
2answers
649 views
Secure communication between C# client and Java server, using certificates
I want to secure communication between simple C# WPF client and Java server. Now i have already implemented raw sockets communication, and my security is based on:
server send RSA public key to ...
2
votes
1answer
427 views
How to use DPAPI under load balance environment
DPAPI can be used to encrypt the secret data. We intend to use it in our web app to encrypt some data and store the encrypted data in database. When needed we decrypt the data and present them on ...
4
votes
4answers
2k views
Reflector - obfuscated code
I run Reflector to de-compile some program and it seems to be obfuscated.
I got following output, it’s not very useful.
Any ideas how to decompile obfuscated code?
[CompilerGenerated]
get
...
3
votes
2answers
831 views
How to store IV and key temporarily but securely
I am using .NET 4.0 to develop a Windows service that will temporarily store encrypted data in a database. The data will be encrypted when it is inserted, then decrypted, processed, and deleted once ...
6
votes
2answers
1k views
C# Image.FromStream is that secure?
after reading the data from the request as Stream i needed to convert it to Image so i used this Method:
Stream inputStream = HttpContext.Current.Request.InputStream;
Image img = ...
3
votes
1answer
229 views
Does strong naming remove the need for packing/obfuscation?
I'm new to .NET programming, and I'm wondering - from a security perspective - whether the strong naming scheme used in .NET assemblies completely removes the need for other commonly used techniques ...
