Tag Info

New answers tagged

0

There are several libraries that allow for authenticated encryption in .NET. Bouncy Castle, mentioned in an earlier answer, is not. Microsoft itself offers an open source library that is quite low-level, just wrapping the CNG APIs that offer authenticated symmetric encryption in Windows, called CLR Security. The CLR Security library is going to be the ...


0

This is probably a little late but just as a recommendation for other people who stumble on this. For this type of problem I would always use ProtectedData over rolling your own implementation with AesManaged for two reasons. First, you don't need to deal with managing cryptographic keys with ProtectedData which is a hassle to do correctly. Second, there's a ...


1

Salt is not really about entropy. What salts must achieve is uniqueness: as much as possible, you must try never to reuse a salt value (even if changing the password for the same user). GUID are nice for that. Randomness is a nice method to achieve that kind of uniqueness with overwhelming probability (it is "nice" because it does not need any kind of ...


4

Simply put, you want to maximize the amount of entropy for a given length of data, when doing most cryptographic tasks. You have (at most) 16 bytes of entropy in your GUID - probably less (some of the bits are deterministic), but we can ignore that detail for the current discussion. When using the GUID's byte[] representation as a salt, you have 16 bytes of ...


0

If you are using MSSQL, switch to Transparent Data Encryption and don't encrypt by yourself. This will be massively more maintainable as you will be able to run queries against the data while encrypted. https://connect.microsoft.com/SQLServer/feedback/details/676553/transparent-data-encryption-tde-for-sql-server-standard Failing that (due to licensing?) ...


7

An elliptic curve is a point in a bi-dimensional space, hence it has two coordinates (usually called X and Y) which are values in some field. In the case of P-192, the field consists in integers modulo a prime p of length 192 bits (p lies between 2191 and 2192). The curve points are the (X,Y) pairs that fulfil the curve equation (Y2 = X3 + aX + b for two ...


5

Rfc2898DeriveBytes implements the standard algorithm known as PBKDF2 and defined in RFC 2898 (hence the name). That algorithm uses a configurable underlying pseudorandom function, which is usually HMAC, and HMAC itself relies on a configurable underlying hash function, usually SHA-1. While all of this is configurable, a given implementation might not be as ...


1

If in generating the page you add a hash token based on timestamp plus a secret then by including the timestamp and token in each request you can make it harder to craft attacks. The token can be checked without recourse to the database. Any request with a timestamp that is too old should also be rejected. If this is a one-page app or similar where the page ...


1

You cannot avoid the cost of a lookup: at one point, you will have to perform one if only to see if the sender is blacklisted or not. So, your best option is probably to make sure a token lookup is quick enough to handle the load. However, you should still keep a trace in your DB of invalid attempt with associated source. Such a trace should make it easy ...


1

Fail2ban is a nice option, but it will create some problems if a sizable part of your userbase is behind a proxy, and someone on that proxy abuses your service and locks out every single user of the proxy. You probably have a traditional database (MySQL, Postgres, Oracle, DB2) hosting your data, but the overhead of the tokens are too high for them. You ...


0

You might try to use fail2ban or similar software and implement a "request limit" rule. It will be based on the IP address but you will not need to have a check in your database for every request. Moreover, when an IP will be blacklisted, it will not reach your webservice anymore as the firewall will block the incoming request before.


0

There is an effort to allow C# to produce deterministic builds with Roslyn. This allows you to verify that the source matches the binary. While they are not there yet you can see the progress at https://github.com/dotnet/roslyn/issues/372 Why is this important? The ability to identically reproduce builds is of increasing importance and visibility ...



Top 50 recent answers are included