I am fairly new to this, so I'm sure it has been asked and answered but I cannot find a clear answer. If this has already been addressed, please point me in the right direction and I will remove this question.
I have a program which will need to accept a username and password from the user. This username and password is for another server, but the information will need to be passed around a few DLLs before sending the final request to the other server. My concern is with passing usernames and passwords between DLLs without encryption, so I have made a simple Encrypt and Decrypt method set using Microsoft's System.Security.Cryptography.CryptoStream class.
Essentially, the following operations are performed.
A plain string is entered into the encryption method along with the encryption key. This method then generates a random IV (8 byte), random array (8 bytes) and the byte array encryption. The IV, random array, and encryption are then put into a single byte array and passed around between DLLS.
The byte array is received by a DLL and passed through the decryption method with the encryption key. This method grabs the IV part of the array and the encryption part of the array, and ignores the random 8 bytes added (these are added simply for totally arbitrary reasons). The string is then decrypted.
Have I accidentally broken the whole security of using an encryption by appending the IVs to the encrypted byte array?
Should I be using the random 8 bytes as salt (just, since I have them anyway) and passing them through with the encryption? Or would that just break it even further?
Note that I have no direct access to a list of usernames or passwords, this is an entirely external application. I just want to ensure that the request and movement of username and password pairs are secure on my end.