C# Security programming problem

[pei_world]

Hi there,

I am using the following code to produce a encryption key for my password.
//===========================================================
password = "a password";
....
...

System.Text.UTF8Encoding enc = new System.Text.UTF8Encoding();
Rijndael crypt = Rijndael.Create();
byte[] salt = new byte[8];
RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
rng.GetBytes(salt);
PasswordDeriveBytes pdb = new PasswordDeriveBytes(password,salt);

byte[] key = pdb.GetBytes(16);

crypt.Key = key;
crypt.IV = new byte[16];
//==================================================================
my problem is that since salt produce randomly everytime,
how does people using it to decrypt message?
Is there any way I can produce the same encrypted password
or get back original password by decrypt the key?

thank

pei

 

[mikeb]

Hi there,

I am using the following code to produce a encryption key for my password.
//===========================================================
password = "a password";
....
...

System.Text.UTF8Encoding enc = new System.Text.UTF8Encoding();
Rijndael crypt = Rijndael.Create();
byte[] salt = new byte[8];
RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
rng.GetBytes(salt);
PasswordDeriveBytes pdb = new PasswordDeriveBytes(password,salt);

byte[] key = pdb.GetBytes(16);

crypt.Key = key;
crypt.IV = new byte[16];
//==================================================================
my problem is that since salt produce randomly everytime,
how does people using it to decrypt message?
Is there any way I can produce the same encrypted password
or get back original password by decrypt the key?

You need to store the salt - either with the user's 'profile' data or
with the encrypted data.

The salt is not considered a secret - it's purpose is to prevent
dictionary attacks against the hashed password.

 

[Chad Myers]

Hi there,

I am using the following code to produce a encryption key for my password.
//===========================================================
password = "a password";
....
...

System.Text.UTF8Encoding enc = new System.Text.UTF8Encoding();
Rijndael crypt = Rijndael.Create();
byte[] salt = new byte[8];
RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
rng.GetBytes(salt);
PasswordDeriveBytes pdb = new PasswordDeriveBytes(password,salt);

byte[] key = pdb.GetBytes(16);

crypt.Key = key;
crypt.IV = new byte[16];
//==================================================================
my problem is that since salt produce randomly everytime,
how does people using it to decrypt message?
Is there any way I can produce the same encrypted password
or get back original password by decrypt the key?

thank

pei

Some people just hard-code the SALT as it's not really any help towards
security. If you're an NSA super-secure app developer, then maybe, but
otherwise the encryption is pretty good by itself.

-c