I'm trying my hand at simple encryption and decryption. Ideally I'd like to be doing it the 'right' way, ie something secure without doing it in a way that will have a serious hole. I'd prefer to do this using just the standard .NET libraries, rather than utilising an external library. If what I'm doing is horrendously wrong, and simply isn't possible without a third-party library, please let me know!
Anyway, I've done a bit of research online, found various different examples (including on Stackoverflow), and found myself confused as to the best way to go about doing things.
I want to take advantage of streams if possible, ie
CryptoStream, etc. This way I can then take say, a
FileStream or a
MemoryStream and encrypt/decrypt them as desired.
This code is intended mainly 'proof of concept and how I should go about doing things'. It's got a generated
key, a generated
iv, and it seems to work with the example string I have there.
It's all one simple application. However, in theory, rather than encrypting a string, I'd be encrypting a file that is on some webserver, and sending the encrypted file over a web-service, and decrypting it client-side. That's the idea.
I've read that it's good practice to generate a random key. If I do that, then both the server and the client would need to know the same key. I assume this would then mean that I'd need to transmit the key in the call to the web-service from the client. Is that correct? Is that secure? I'd assume that the call to it would be done via HTTPS, but is there anything else I'd need to be aware of in that scenario?
The code I've provided is in VB.NET, and is below. Be brutal! If there is need of any further information, ask in the comments and I will try to provide it!
Module Module1 Sub Main() Using aes As System.Security.Cryptography.Aes = System.Security.Cryptography.Aes.Create() Dim unencryptedValue As String = "My test string" Console.WriteLine("Unencrypted: " & unencryptedValue) Dim encryptedData As Byte() = Encrypt(aes.Key, System.Text.UTF8Encoding.UTF8.GetBytes(unencryptedValue)) Dim decryptedData As Byte() = Decrypt(aes.Key, encryptedData) Dim decryptedValue As String = System.Text.UTF8Encoding.UTF8.GetString(decryptedData) Console.WriteLine("Decrypted: " & decryptedValue) Console.ReadKey() End Using End Sub Public Function Encrypt(key As Byte(), unencryptedData As Byte()) As Byte() Using aes As System.Security.Cryptography.Aes = System.Security.Cryptography.Aes.Create(), ms_unencrypted As New IO.MemoryStream(unencryptedData), ms_encrypted As New IO.MemoryStream() Using cs As New Security.Cryptography.CryptoStream(ms_encrypted, aes.CreateEncryptor(key, aes.IV), Security.Cryptography.CryptoStreamMode.Write) ms_encrypted.Write(aes.IV, 0, aes.IV.Length) ms_unencrypted.CopyTo(cs) End Using Return ms_encrypted.ToArray() End Using End Function Public Function Decrypt(key As Byte(), encryptedData As Byte()) As Byte() Using aes As System.Security.Cryptography.Aes = System.Security.Cryptography.Aes.Create(), ms_encrypted As New IO.MemoryStream(encryptedData, 0, encryptedData.Length, False, True), ms_decrypted As New IO.MemoryStream() Dim iv(15) As Byte ms_encrypted.Read(iv, 0, 16) Using cs As New Security.Cryptography.CryptoStream(ms_encrypted, aes.CreateDecryptor(key, iv), Security.Cryptography.CryptoStreamMode.Read) cs.CopyTo(ms_decrypted) End Using Return ms_decrypted.ToArray() End Using End Function End Module