2

One of the requirement of the .Net project I am working now is to secure private information such as SSN, DOB and Password.. We are performing required encryption when we are saving the data but what are the things we need to do secure data in memory before it is stored in the DB ?

What is the best encryption algorithm for our case?

1
  • Okay. Also, encrypting the DB would make it difficult to for you to run range queries on DOB ( born after 1st Jan 2000). Would you be okay with that? – Limit Jan 19 '17 at 3:48
4

The first thing you need to consider is how you are managing the sensitive information in your code. As an example if you manage your password(plain text) using a string data type, there is a high risk that some one can grab your password from the memory. Because in .Net, the String data type is immutable and you do not have any control over it.

So the best way to manage sensitive string data in a .Net app is by using the SecureString class. It is managing string data as byte arrays and you do not need to worry about data conversions etc.. You can use the Dispose() method when ever you finish your work with sensitive data.

        // Instantiate the secure string.
        SecureString securePwd = new SecureString();
        ConsoleKeyInfo key;

        Console.Write("Enter password: ");
        do {
           key = Console.ReadKey(true);

           // Ignore any key out of range.
           if (((int) key.Key) >= 65 && ((int) key.Key <= 90)) {
              // Append the character to the password.
              securePwd.AppendChar(key.KeyChar);
              Console.Write("*");
           }   
        // Exit if Enter key is pressed.
        } while (key.Key != ConsoleKey.Enter);
        Console.WriteLine();

        try {
            Process.Start("Notepad.exe", "MyUser", securePwd, "MYDOMAIN");
        }
        catch (Win32Exception e) {
            Console.WriteLine(e.Message);
        }
        finally {
           securePwd.Dispose();
        } 

What is the best encryption algorithm for our case?

I hope you are not using encryption in passwords ? Passwords need to hashed using good salt and good hashing algorithm. Do not use MD5 or SHA1 because these are weak hashes according to the current standards. At the moment we can consider the PBKDF2 is one of the best hashing algorithms available. The AspNet Identity framework using the PBKDF2.

You can use AES algorithm to encrypt your other sensitive data. But keep in mind to secure your keys. You can use the .Net Key container for that purpose

2
  • Personally I'd look at BCrypt over PBKDF2; from a hashcat cracking perspective PBKDF2 can be better accelerated with GPUs vs BCrypt which works against GPU optimization via its extended and modified key schedule making it difficult/currently impossible to parallelise on a card. As such, PBKDF2 is easier to brute force offline with consumer hardware. Wording around BKS a bit iffy due to char limit. – Chris McKee Mar 10 '17 at 14:01
  • 2
    Microsoft doesn't recommend SecureString for .NET Core. github.com/dotnet/platform-compat/blob/master/docs/DE0001.md – scottheckel Jul 10 '19 at 13:08
0

If you're using C#, you can use the SecureString class under the System.Security directive. More info at MSDN. This API ensures that the contents are more difficult, though not impossible, to get at. This encryption/obfuscation will prevent against grep'ing memory dumps for SSN/DOB patterns or even passwords (i.e; the attacker's own password to find the memory area).

Assuming you have your encryption at rest (DB) figured out, ensure that your system's overall security hygiene is up to par. Anyone with superuser access could potentially read memory / swap files; which is what you want to avoid.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.