# Basic Crypto for .NET

Please tell me if I'm doing this right, and what else is needed to make this hardened.

It seems like it's too simple, like there's almost nothing I'm actually doing. For example, there are 4 or 5 stacked using statements!

Here is the code to review:

class Program
{
static void Main(string[] args)
{
var enc = true;
var fileIn = string.Empty;
var fileOut = string.Empty;

/* parse command line to populate enc, fileIn, fileOut */

Console.Write("key: ");
var key = Encoding.UTF8.GetBytes(Console.ReadLine());
Console.Write("IV: ");
var iv = Encoding.UTF8.GetBytes(Console.ReadLine());

using (var aes = AesManaged.Create())
using (var md5 = MD5.Create())
using (var writeStream = File.OpenWrite(fileOut))
using (var cryptoStream = new CryptoStream(
enc ? writeStream : readStream,
enc
? aes.CreateEncryptor(md5.ComputeHash(key), md5.ComputeHash(iv))
: aes.CreateDecryptor(md5.ComputeHash(key), md5.ComputeHash(iv)),
enc ? CryptoStreamMode.Write : CryptoStreamMode.Read))
{
if (enc) { readStream.CopyToAsync(cryptoStream).Wait(); }
else { cryptoStream.CopyToAsync(writeStream).Wait(); }
}
}
}

• CreateEncryptor() and CreateDecryptor both return an IDisposable object which should be wrapped in a using clause before it's passed to the CryptoStream. May 26 '17 at 1:01
• I think to get the best value out of reviews/answers, you should definitely include the /* parse command line to populate enc, fileIn, fileOut */ commented-out part. May 26 '17 at 1:47
• @jesse good catch! May 26 '17 at 14:38
• In what context will this program be used? Why do you hash the given key and IV, instead of giving the user full control over the input? Also, there are known attacks against MD5. I don't know how that affects your use of it here, but I'd use a more secure algorithm just to be sure. May 26 '17 at 18:26
• @mat's mug I can't! The app wouldn't let me submit it with that code. May 26 '17 at 22:50