Help With System.Security.Cryptography

[HiBoo]

I'm new with .NET and trying to figure out the use of encryption. I've created an app that utilizes XML as a data source and I want to learn how best to encrypt the xml file. What I'm missing in this code is the ability to shut the application down and run it again later without losing the encryption key values.

I've created two procedures to import and export the data. The variable m_encrypted is a private variable string that indicates the xml file name. The Key and IV variables are also privately declared and I know this is what I have to change but I'm uncertain where to go with it.

Private Sub LoadEncryptedData()
        Dim stream As New System.IO.FileStream _
                    (m_encrypted, System.IO.FileMode.Open)

        Dim tdes As New TripleDESCryptoServiceProvider
        tdes.Key = key
        tdes.IV = IV

        Dim cs As New CryptoStream(stream _ 
            , tdes.CreateDecryptor(), CryptoStreamMode.Read)
        Me.DsDirectory.Tables(0).ReadXml(cs)
        cs.Close()
        stream.Close()

End Sub

Private Sub ExportEncryptedData()

        Dim stream As New System.IO.FileStream _
             (m_encrypted, system.IO.FileMode.OpenOrCreate)

        Dim tdes As New TripleDESCryptoServiceProvider
        Dim cs As New CryptoStream(stream _
                            , tdes.CreateEncryptor() _
                            , CryptoStreamMode.Write)
        Me.DsDirectory.Tables(0).WriteXml(cs)

        key = tdes.Key
        IV = tdes.IV

        cs.Close()
        stream.Close()

    End Sub

Where is the best place to store the Key and IV variables after exporting the data to the xml file so that they are safe and secure and are retrievable after the application has been closed and reopened? The Key and IV variables are byte arrays.

 

[Mastakilla]

hi,

you could try using constants instead of variable.

 

[HiBoo]

Mastakilla, do you mean a constant value for the Key and IV values? Would this not compromise the security of the encryption as a hacker could retrieve the constant values if stored in the code. The TripleDESCryptoServiceProvider randomly generates a Key and IV value when the CreateEncryptor() function is passed through the CryptoStream function. I want to know how best to store the Key and IV values generated when created during the Export procedure so that they can be used again when the data is imported back into the application once it has been shut down and re-opened.

I think I need to use a User setting in the My.Settings namespace but I'm not sure how to store a byte array as in VS2005 it won't let me create one.

 

[Mastakilla]

It would compromise security if you don't protect your assembly. There are some software on the market that can prevent hackers from breaking into your code(ex: CodeVeil).