0

First of all I am not very familiar with the world of encryption so please be nice.

I have got a data that should store in an xml using NetDataContractSerializer. This xml file gets the size of from 5MB to 10MB. So I am zippping this file with other xml files (not required encryption due to insensitive info) into one file in order to lower the size.

Due to security reason, I like to encrypt some part of this xml (still major part of a xml file) but it will need to be compressed with other files and encrypted data will not compressed much at the end.

Some articles say compression need to be done prior to encryption. Is there any efficient way of serializing the data and compressed then encrypted? Or all at once conveniently?

Anyone faced similar issue and resolved in a different/smarter way?

  • What lacks in your question is to know if your need is to compress the file to be stored or to be transported to some other endpoint. In the second case, you need to make sure that whatever cryptography you use will be understood by the other party so that it will be able to decrypt. In which case XMLSecurity standard may make sense for interoperability but be warned, it is tricky. If it is only the first case (storing encrypted) then you can apply whatever solution you want, like PGP (which also gives you the feature of authentication if needed) or with openssl tool. – Patrick Mevzek Jul 14 '18 at 1:00
  • @PatrickMevzek Thanks for comment. Actually stored locally as a file and serialized to be transported. But when transport, I don't need either to encrypt or to compress. So only need to compress and encrypt when storing into a file. – KayJay Jul 15 '18 at 22:03
1

Some articles say compression need to be done prior to encryption.

Compression should be done before encryption because encrypted data will not be compressible. So, if you encrypt first then there is no point in trying to compress the encrypted data further.

This happens because the encryption algorithm causes the encrypted data to look like just random data, and random data can not be compressed, generally speaking.

You can certainly encrypt part of a file first if you like, that just will make the file a bit less compressible.

  • Thanks for your post. I am no longer insisting to encrypt it first before compression. But looking for a way to compress xml with encryption (for security reason - not expose some data) with using NetDataContractSerializer. – KayJay Jul 13 '18 at 5:08
1

There is a standard for Xml encryption, from w3c. It is complex and has several shortfalls but that will provide some level of interoperability should it be needed

Otherwise,the simplest is to use pgp to encrypt your file and put that into your zip. Pgp incluses an optional compression stage so you don't need to bother with that

  • Base64-encoded PGP could also be embedded into the document itself, since the question specifies that not all of the file needs to be encrypted. PGP does have the advantage of native compression support, and flexibility in choosing the encryption algorithm may be beneficial. – nbering Jul 13 '18 at 6:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.