9 reputation
5
bio website
location
age
visits member for 1 year, 6 months
seen Aug 1 '13 at 4:11

Oct
9
comment What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase
Could you point me in the right direction regarding implementing GPG for C# ASP.NET? I am aware of the 'Starksoft .NET GnuPG Component' - are there others? Thanks.
Oct
9
comment What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase
+1 for addressing the other issue in my question. Part of implementing a new solution will necessitate migration. I will take on board your excellent advice in parallel with identifying a suitable replacement encryption/decryption implementation.
Oct
9
comment What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase
Thanks. I think you've identified the key issue; namely to use a high-level library.
Oct
9
comment What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase
@Stephen Touset: We are using the CBC cipher mode (pretty much as seen in the original link/solution). It is [now] clear from the comments and my own research that our current solution is not good/strong enough.
Oct
9
comment What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase
@CodesInChaos: Thanks. However, does this answer specifically describe the use of AES (i.e. instead of Rijndael)? I admit it was my mistake to include "AES" in my question.
Oct
9
comment What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase
@Stephen Touset: Thanks for replying. Although I did not implement it myself, I am currently reviewing its suitability. I mentioned "AES" in ignorance, and have now removed it from my question. Our implementation actually looks very similar to the one found in the link I first posted, and I am keen to replace it with a more robust solution. (Naturally before I take action, I should understand why the current solution is not adequate.)
Oct
9
comment What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase
@CodesInChaos: Thanks for your replies. I have removed "AES" from the question as I now realise it is not correct.
Sep
27
comment What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase
@ Loadmaster: I've just update my question with an example which highlights my concerns.
Sep
27
comment What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase
@ Loadmaster: also, as you suggest all three values could/should be changed, does this mean that data already encrypted using previous values (of salt/pass/IV) will be successfully decrypted (i.e. giving the correct/expected output) using the new salt/pass/IV values?
Sep
27
comment What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase
@ Loadmaster: given the following scenario, what would you recommend as a course of action?: a CS class currently contains a fixed class-level pass phrase, salt and IV, and two functions (Encrypt and Decrypt) which use the same three fixed values every time for calls to retrieve/post data from the database.