I'm working with another company in a new application for my company. My job right now is to send on demand to the other company the data that they need, ciphering some of it.
I should point out that the key is not going to be stored in any database.
Here's the code that I wrote, intended to be used in both services.
using System;
using System.IO;
using System.Security.Cryptography;
using System.Text;
namespace RETACrypto
{
public static class CryptoHelper
{
#region Fields
private const int maxIVLength = 16;
private const int maxSaltLength = 32;
private const string password = "lmnKNG6IJVEcsMkaJgnFyZVG0lINDOzv";
#endregion
#region Public Methods
public static string EncryptString(string source)
{
try
{
string result = "";
byte[] resultBytes;
byte[] encriptedSource;
byte[] salt = GetSalt(maxSaltLength);
using (var aes = new AesManaged { Key = GetKey(salt, Encoding.UTF8.GetBytes(password)), Mode = CipherMode.CBC, Padding = PaddingMode.PKCS7 })
{
byte[] sourceByteArray = Encoding.UTF8.GetBytes(source);
using (var encryptor = aes.CreateEncryptor(aes.Key, aes.IV))
{
encriptedSource = encryptor.TransformFinalBlock(sourceByteArray, 0, sourceByteArray.Length);
}
resultBytes = new byte[aes.IV.Length + salt.Length + encriptedSource.Length];
Array.Copy(aes.IV, 0, resultBytes, 0, aes.IV.Length);
Array.Copy(encriptedSource, 0, resultBytes, aes.IV.Length, encriptedSource.Length);
Array.Copy(salt, 0, resultBytes, aes.IV.Length + encriptedSource.Length, salt.Length);
}
result = Convert.ToBase64String(resultBytes);
return result;
}
catch (Exception)
{
throw;
}
}
public static string DecryptString(string source)
{
try
{
string result = "";
byte[] sourceByte = Convert.FromBase64String(source);
byte[] resultIV = GetPartOfTheMessage(sourceByte, 0, maxIVLength);
byte[] salt = GetPartOfTheMessage(sourceByte, sourceByte.Length - maxSaltLength, maxSaltLength);
sourceByte = GetPartOfTheMessage(sourceByte, maxIVLength, sourceByte.Length - maxIVLength - maxSaltLength);
byte[] resultByte;
int decryptedByteCount = 0;
using (var aes = new AesManaged { Key = GetKey(salt, Encoding.UTF8.GetBytes(password)), IV = resultIV, Mode = CipherMode.CBC, Padding = PaddingMode.PKCS7 })
{
using (ICryptoTransform AESDecrypt = aes.CreateDecryptor(aes.Key, aes.IV))
{
using (MemoryStream memoryStream = new MemoryStream(sourceByte))
{
using (CryptoStream cs = new CryptoStream(memoryStream, AESDecrypt, CryptoStreamMode.Read))
{
resultByte = new byte[sourceByte.Length];
decryptedByteCount = cs.Read(resultByte, 0, resultByte.Length);
}
}
}
result = Encoding.UTF8.GetString(resultByte);
if (decryptedByteCount < result.Length)
{
result = result.Substring(0, decryptedByteCount);
}
}
return result;
}
catch (Exception)
{
throw;
}
}
#endregion
#region Private Methods
private static byte[] GetSalt(int length)
{
byte[] salt = new byte[length];
using (RNGCryptoServiceProvider random = new RNGCryptoServiceProvider())
{
random.GetNonZeroBytes(salt);
}
return salt;
}
private static byte[] GetKey(byte[] salt, byte[] password)
{
byte[] combine = new byte[salt.Length + password.Length];
byte[] result;
try
{
Array.Copy(salt, combine, salt.Length);
Array.Copy(password, 0, combine, salt.Length, password.Length);
using (SHA256 sha256Hash = SHA256.Create("SHA256"))
{
result = sha256Hash.ComputeHash(combine);
}
}
catch (Exception)
{
throw;
}
return result;
}
private static byte[] GetPartOfTheMessage(byte[] source, int startPoint, int length)
{
byte[] result = new byte[length];
Array.Copy(source, startPoint, result, 0, length);
return result;
}
#endregion
}
}
Now, my questions:
- What's the best way of storing
maxIVLength,maxSaltLengthand; most importantly,passwordso there are no magic variables in my code? - Right now I am storing the IV at the beginning of the message and the salt at the end. Should I keep it like this or store all at the beginning or end?
- Is my use of
RNGCryptoServiceProviderok or should I make a static variable so I only construct it once? How do you dispose of it in that case?
There probably are other potential problems or mistakes that I've overlooked, feel free to point them out.
problems of mistakessuch as no spelling checker being able to tell or should go whereofstands?) \$\endgroup\$try/catch/throwstatements do nothing. \$\endgroup\$