A runtime, architecture, and libraries for Microsoft Windows used for creating applications.
70
votes
21answers
16k views
Lessons learned and misconceptions regarding encryption and cryptology
Cryptology is such a broad subject that even experienced coders will almost always make mistakes the first few times around. However encryption is such an important topic, often we can't afford to ...
10
votes
7answers
3k views
What are the realistic, and most secure crypto for Symmetric, Asymmetric, Hash, Message Authentication Code ciphers?
I'm interested in updating this two pronged question for 2011:
What cryptology is most appropriate for low-powered devices (such as a cellphone), and yet still effective?
What cryptology is most ...
10
votes
6answers
5k views
Is PBKDF2-based System.Cryptology.RFC2898DeriveBytes() “better” for Unicode Password hashing than traditional methods?
When is it appropriate to use RFC2898DeriveBytes versus a typical hash?
Update
I now understand that a KDF is typically used to create a symmetric key for possible use in encrypting a stream. I ...
10
votes
4answers
947 views
Using computer random number generators to produce keys, it is secure?
Does generating an encryption key using the random number generator on one's computer present a security risk? If so how might that risk be mitigated, specifically when generating RSA key pairs in ...
9
votes
3answers
702 views
How can I encrypt a file with .NET and have the same file size of the original file?
I'm using .NET and I've written an awesome routine (xD) that encrypts and decrypts a file using AES256 CBC. It works perfectly, but now they told me that the encrypted file must be of the same size of ...
7
votes
4answers
1k views
What Partial Homomorphic Encryption implementations exist and how do I leverage them?
It appears that only Partial Homomorphic Encryption(P.H.E.) is practical for modern day (2011) use. However I'm having difficulty locating libraries (FOSS or otherwise) that enable me to leverage ...
7
votes
2answers
1k views
Data Encryption and Key Management in C#
Which route to take, what are the pros and cons, which is more secure..
Generate AES key, encrypt the data with it and then encrypt the AES key with RSA, save the encrypted data and encrypted AES ...
7
votes
1answer
306 views
A practical .NET Remoting Architecture exploit
If you were to demonstrate a .NET Remoting Architecture vulnerability with a practical attack, which one would you choose?
I've read J. Forshaw's white paper on Breaking .NET Through Serialization ...
6
votes
2answers
1k views
C# Image.FromStream is that secure?
after reading the data from the request as Stream i needed to convert it to Image so i used this Method:
Stream inputStream = HttpContext.Current.Request.InputStream;
Image img = ...
6
votes
3answers
311 views
Is it safe to binary-deserialize user-provided data?
AppHarbor has a blog post containing sample C# code which reads data from an unsigned cookie and passes it through .Net binary serialization.
Is that safe?
Obviously, the data is completely ...
6
votes
1answer
371 views
Secure query string parameters
I have an application which use the Thick box jQuery component to open a popup page .
And I pass my parameters in query string like this :
<a id="btnShowPopup6" runat="server" class="thickbox" ...
6
votes
2answers
363 views
Production ready bcrypt implementation for .NET
Which, if any, .NET / C# bcrypt implementations are considered suitable for production environments?
I have seen CryptSharp and BCrypt.Net mentioned in answers to other questions but without any ...
5
votes
3answers
218 views
Why must all classes' data members be set to private?
In OO programming courses, teachers always tells us to set class members to private unless there is a good reason because it is more "secured".
How does setting members to private makes the program ...
5
votes
4answers
435 views
Gold Standard for password hashing
I've developing a web application that will be dealing with highly sensitive information and I want to ensure the hashing of passwords is gold standard. Ideally I'd go for per-user salted SHA512 ...
5
votes
1answer
471 views
“Hello World” example of a Buffer Overflow attack in many programming languages
I'm looking for a very simple application that has an intentional Buffer Overflow embedded in it. I'm assuming this possible in systems where DEP and ASLR are not being used
Ideally (and if ...
5
votes
1answer
89 views
Does every security patch get back ported to every .NET framework? Are there exceptions to the rule?
I can imagine a scenario where Microsoft will create a security patch for some versions of .NET and not others. This might occur in occasions it's too expensive to regression test and back port all ...
4
votes
2answers
3k views
Diffie Hellman c# implementation
Hallo all,
For a test project I have tried to implement the (famous) Diffie Hellman algorithm for safe key exchange.
Now I have written this in C#:
using System;
using System.Collections;
using ...
4
votes
4answers
2k views
Reflector - obfuscated code
I run Reflector to de-compile some program and it seems to be obfuscated.
I got following output, it’s not very useful.
Any ideas how to decompile obfuscated code?
[CompilerGenerated]
get
...
4
votes
2answers
205 views
How to correctly implement AES in a backup application
I am writing a back-up application which should have the feature of encrypting the back-up. It must encrypt file data, paths and filenames. The application is being written in C# (.NET). Target is ...
4
votes
2answers
162 views
Is it a security risk to maintain an application developed for a version of .NET prior to 4.0?
I've had a request that we upgrade all our internally developed applications to .NET v4.0.
Needless to say, this is a massive chunk of work. Is using applications based on the .NET framework prior to ...
4
votes
2answers
1k views
Reference implementation of C# password hashing and verification
Does anyone have a reference implementation (ideally 3rd party certified, or government approved) way one-way hash a password for C# and or Java?
Ideally,I'd like to see something that includes a ...
4
votes
1answer
86 views
Does the compiler feature of Closures decrease member variable security?
Based on this discussion, closures in C# promote private variables to public variables at compile time.
Suppose a closure was implemented on a Username or Password string. Would there be any ...
4
votes
1answer
506 views
Why does Bouncy Castle have a separate download for the IDEA algorithm?
I'm looking at downloading the C# binary for Bouncy Castle and see two downloads with source code. One has the IDEA algorithm, the others presumably not.
http://www.bouncycastle.org/csharp/
Why ...
4
votes
1answer
197 views
Anyone use the International Domain Name (IDN) security mitigation API's? Is there a wrapper for .NET?
The International Domain Name mitigation API's are available here for download:
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=ad6158d7-ddba-416a-9109-07607425a815&displaylang=en
...
4
votes
2answers
439 views
How should an application store its credentials
When developing desktop applications, you will occasionally have to store credentials somewhere to be able to authenticate your application. An example of this is a Facebook app ID + secret, another ...
4
votes
1answer
1k views
What's the risk of changing permissions of the Security Eventlog registry key to IT operations?
Background
Many developers are unnecessarily lowering the security of the event log, or requiring applications to run in Administrator mode just so they can use the event log with this C# or VB code:
...
4
votes
2answers
142 views
How do I remove or anonymize file names and path that are stored in compiled .NET exe output?
When an exception occurs in a .NET application, the exception output also includes the path and file name of the code file that resided on the developer's machine. This shares some information that ...
3
votes
2answers
766 views
How to store IV and key temporarily but securely
I am using .NET 4.0 to develop a Windows service that will temporarily store encrypted data in a database. The data will be encrypted when it is inserted, then decrypted, processed, and deleted once ...
3
votes
3answers
100 views
Identifying and preventing execution of “any” function via Late-Bound commands
The Command Pattern is widely used to create a robust, salable applications. However I see guidance in this MSDN article that could allow a caller to invoke a late-bound command... enabling the ...
3
votes
1answer
153 views
When does one need to be concerned with leaking timing information in .NET?
According to this post, Dominick Baier was comparing two HMACSHA256 signatures and was leaking timing information upon an unsuccessful comparison.
When working with .NET crypto classes, when should ...
3
votes
1answer
2k views
How do I use C# to encrypt/decrypt data where the private key is on a smartcard, hardware security module, TPM chip etc
Is anyone aware of a C# code sample to interact with smartcard, hardware security module, TPM chips (etc), that will allow me to encrypt and decrypt data?
My goal is to allow my application to ...
3
votes
1answer
577 views
Peer review of C# cryptography for Azure Table security
Edit: Update - I am researching how to implement AES with authentication in an efficient way for this project. If you have the time I'd appreciate your skill in finding the best implementation for ...
3
votes
1answer
549 views
Encrypt Medicare card numer in C# in ASP.NET
I am giving a free consultation for a non profit organisation that wants a simple system to manage multiple groups with a schedule component, etc. and also manage the medical informations of the kids. ...
3
votes
1answer
223 views
Does strong naming remove the need for packing/obfuscation?
I'm new to .NET programming, and I'm wondering - from a security perspective - whether the strong naming scheme used in .NET assemblies completely removes the need for other commonly used techniques ...
2
votes
3answers
856 views
Securing AES 128 encrypted ZIPs against brute force attacks
How long would it take to brute force decrypt an AES 128 encrypted zip file if the password is 8 characters long in the range of A-Z, a-z, 1-9?
Does it make any difference if .NET's System.Random ...
2
votes
1answer
93 views
Using MySQL in .NET and other easily-decompiled languages?
How would people use MySQL in C#, or really any other managed application? Couldn't someone simply decompile the application and find out the password/etc. for the database?
2
votes
2answers
190 views
Are GUID visible when compiling a .NET project?
I know if a person has a GUID from a machine that person can figure out if other guid belongs to that machine.
In a .NET project (csproj and the visual studions solution file) GUIDs are generated. If ...
2
votes
3answers
505 views
How to do a virus scan before post attachments in asp.net application
How to do a virus scan before post attachments in asp.net application,when they find a virus on to give up post attachments,otherwise proceed to upload.
I wonder if there are any APIs out there where ...
2
votes
3answers
784 views
AES for key encryption
Is AES a good choice for protecting a key stored on the computer of a user of my application? I have seen threads on hashing passwords that suggest using slow algorithms for defending against brute ...
2
votes
1answer
42 views
How does a function certificate work?
Say that we have a client / server solution (written in .NET). If we want to use a certificate for the TCP communication, is it enough to use one function/service certificate to encrypt communication ...
2
votes
1answer
183 views
Are there any functional differences in the implementations of OpenSSL, GnuTLS, Java's TLS, and .NET's TLS?
Question
Are there any functional (or detectable) differences between the various implementations of SSL/TLS? What are the differences between them? (e.g. which ones implement "False Start")
...
2
votes
2answers
627 views
Secure communication between C# client and Java server, using certificates
I want to secure communication between simple C# WPF client and Java server. Now i have already implemented raw sockets communication, and my security is based on:
server send RSA public key to ...
2
votes
1answer
375 views
Are .NET WebServices vulnerable to CSRF?
While developing TeamMentor I implemented a number of WebServices (consumed via jQuery) and now on its final push for release I want to double check that they are not vulnerable to CSRF.
There isn't ...
2
votes
2answers
298 views
What is the correct way to assess and compare Certicom's products to the alternatives?
I'm investigating Certicom's API because they are "free" with the Blackberry implementations, and have come to realize that I have several alternatives for implementing crypto such as BouncyCastle, ...
2
votes
1answer
67 views
How to Verify the Identity of the Caller of a Web Service
I have a server which is composed of a page and a web service. The web service is intended to be used by a Windows Phone mobile application that I will develop myself.
Now, my question is, how do I ...
2
votes
1answer
413 views
Using GPG or PGP for symmetric database encryption/decryption in c#
I am looking to symmetrically encrypt/decrypt information in a database. This info consists of short pieces of information, which need to be individually encrypted when a specific method is called.
I ...
2
votes
2answers
100 views
Why would encrypting data result in a call to a Domain Controller
This KB article mentions an issue where signing or encrypting information may result in a network IO call to a Domain Controller.
Apparently the RSACryptoServiceProvider's SignData and VerifyData ...
2
votes
1answer
420 views
How to use DPAPI under load balance environment
DPAPI can be used to encrypt the secret data. We intend to use it in our web app to encrypt some data and store the encrypted data in database. When needed we decrypt the data and present them on ...
2
votes
3answers
254 views
What are the best security practices to install a C# Web App on client servers?
We would like to install a Web App written in C#/.NET4 on client servers, not ours. I would like to know what are the best security practices to implement for avoid the following:
Authority ...
2
votes
2answers
571 views
C# Encrypting string in DES 3 CBC mode
Is it normal that when I use Double DES secret key to encrypt a string in DES3 CBC mode then I always get the same cipher text? For testing I'm using IVC=0.
