network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 7 months |
| seen | Nov 1 '12 at 14:12 | |
| stats | profile views | 2 |
|
Oct 9 |
comment |
What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase Could you point me in the right direction regarding implementing GPG for C# ASP.NET? I am aware of the 'Starksoft .NET GnuPG Component' - are there others? Thanks. |
|
Oct 9 |
comment |
What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase +1 for addressing the other issue in my question. Part of implementing a new solution will necessitate migration. I will take on board your excellent advice in parallel with identifying a suitable replacement encryption/decryption implementation. |
|
Oct 9 |
comment |
What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase Thanks. I think you've identified the key issue; namely to use a high-level library. |
|
Oct 9 |
comment |
What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase @Stephen Touset: We are using the CBC cipher mode (pretty much as seen in the original link/solution). It is [now] clear from the comments and my own research that our current solution is not good/strong enough. |
|
Oct 9 |
comment |
What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase @CodesInChaos: Thanks. However, does this answer specifically describe the use of AES (i.e. instead of Rijndael)? I admit it was my mistake to include "AES" in my question. |
|
Oct 9 |
comment |
What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase @Stephen Touset: Thanks for replying. Although I did not implement it myself, I am currently reviewing its suitability. I mentioned "AES" in ignorance, and have now removed it from my question. Our implementation actually looks very similar to the one found in the link I first posted, and I am keen to replace it with a more robust solution. (Naturally before I take action, I should understand why the current solution is not adequate.) |
|
Oct 9 |
comment |
What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase @CodesInChaos: Thanks for your replies. I have removed "AES" from the question as I now realise it is not correct. |
|
Sep 27 |
comment |
What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase @ Loadmaster: I've just update my question with an example which highlights my concerns. |
|
Sep 27 |
comment |
What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase @ Loadmaster: also, as you suggest all three values could/should be changed, does this mean that data already encrypted using previous values (of salt/pass/IV) will be successfully decrypted (i.e. giving the correct/expected output) using the new salt/pass/IV values? |
|
Sep 27 |
comment |
What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase @ Loadmaster: given the following scenario, what would you recommend as a course of action?: a CS class currently contains a fixed class-level pass phrase, salt and IV, and two functions (Encrypt and Decrypt) which use the same three fixed values every time for calls to retrieve/post data from the database. |
