Basic Crypto for .NET

Question

Please tell me if I'm doing this right, and what else is needed to make this hardened.

It seems like it's too simple, like there's almost nothing I'm actually doing. For example, there are 4 or 5 stacked using statements!

Here is the code to review:

class Program
{
    static void Main(string[] args)
    {
        var enc = true;
        var fileIn = string.Empty;
        var fileOut = string.Empty;

        /* parse command line to populate enc, fileIn, fileOut */

        Console.Write("key: ");
        var key = Encoding.UTF8.GetBytes(Console.ReadLine());
        Console.Write("IV: ");
        var iv = Encoding.UTF8.GetBytes(Console.ReadLine());

        using (var aes = AesManaged.Create())
        using (var md5 = MD5.Create())
        using (var readStream = File.OpenRead(fileIn))
        using (var writeStream = File.OpenWrite(fileOut))
        using (var cryptoStream = new CryptoStream(
            enc ? writeStream : readStream, 
            enc 
                ? aes.CreateEncryptor(md5.ComputeHash(key), md5.ComputeHash(iv))
                : aes.CreateDecryptor(md5.ComputeHash(key), md5.ComputeHash(iv)),
            enc ? CryptoStreamMode.Write : CryptoStreamMode.Read))
        {
            if (enc) { readStream.CopyToAsync(cryptoStream).Wait(); }
            else { cryptoStream.CopyToAsync(writeStream).Wait(); }
        }
    }
}

Answer 1

I am not an expert in cryptography by any stretch of the imagination but I am pretty sure an IV should be randomly generated.

" In cryptography, an initialization vector (IV) or starting variable (SV)[1] is a fixed-size input to a cryptographic primitive that is typically required to be random or pseudorandom. Randomization is crucial for encryption schemes to achieve semantic security [...] " -

_{https://en.wikipedia.org/wiki/Initialization_vector}

Answer 2

IV it's intended to be quite long and variant, so yep inserting it manually is not a problem but if take an high entropy long string is better.

MD5: it's the weakest hash possible, consider to use SHA-*