9 reputation
15
bio website
location
age
visits member for 1 year, 11 months
seen Aug 1 '13 at 4:11

Jun
11
awarded  Notable Question
Jun
28
awarded  Popular Question
Oct
10
awarded  Supporter
Oct
9
awarded  Commentator
Oct
9
comment What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase
Could you point me in the right direction regarding implementing GPG for C# ASP.NET? I am aware of the 'Starksoft .NET GnuPG Component' - are there others? Thanks.
Oct
9
comment What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase
+1 for addressing the other issue in my question. Part of implementing a new solution will necessitate migration. I will take on board your excellent advice in parallel with identifying a suitable replacement encryption/decryption implementation.
Oct
9
comment What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase
Thanks. I think you've identified the key issue; namely to use a high-level library.
Oct
9
comment What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase
@Stephen Touset: We are using the CBC cipher mode (pretty much as seen in the original link/solution). It is [now] clear from the comments and my own research that our current solution is not good/strong enough.
Oct
9
comment What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase
@CodesInChaos: Thanks. However, does this answer specifically describe the use of AES (i.e. instead of Rijndael)? I admit it was my mistake to include "AES" in my question.
Oct
9
awarded  Editor
Oct
9
revised What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase
Additional information following comments.
Oct
9
comment What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase
@Stephen Touset: Thanks for replying. Although I did not implement it myself, I am currently reviewing its suitability. I mentioned "AES" in ignorance, and have now removed it from my question. Our implementation actually looks very similar to the one found in the link I first posted, and I am keen to replace it with a more robust solution. (Naturally before I take action, I should understand why the current solution is not adequate.)
Oct
9
comment What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase
@CodesInChaos: Thanks for your replies. I have removed "AES" from the question as I now realise it is not correct.
Oct
8
awarded  Student
Oct
8
asked What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase
Sep
27
comment What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase
@ Loadmaster: I've just update my question with an example which highlights my concerns.
Sep
27
comment What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase
@ Loadmaster: also, as you suggest all three values could/should be changed, does this mean that data already encrypted using previous values (of salt/pass/IV) will be successfully decrypted (i.e. giving the correct/expected output) using the new salt/pass/IV values?
Sep
27
comment What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase
@ Loadmaster: given the following scenario, what would you recommend as a course of action?: a CS class currently contains a fixed class-level pass phrase, salt and IV, and two functions (Encrypt and Decrypt) which use the same three fixed values every time for calls to retrieve/post data from the database.