File (XmlDocument) Encryption / Decryption improvements - C# Discussion Boards

thank y... got to lazy to finish that word

modified on Friday, December 07, 2007 12:58:19 PM

I have need of NPlot within a VBA application I am developing.

There are .NET 1.1 and 2.0 dlls available, and also the C# source code. I have been doing some reading on C# interoperability with COM, but I cannot get my head around it, as my C# and .NET skills are severly lacking.

Is it possible for someone to guide me on how exactly to enable COM interoperability in NPlot, so I can insert an NPlot control inside a VBA form? I'm required to use the .NET 1.1 version, as it is the only framework installed on all PCs at my workplace.

Thank you Smile | :)

Hi there,
First in the C# source Code (For VS2005), right click in the project select properties and goto Build section on the bottom select "register For COM Interop" (do that for all projects in the solution), now if you Build the Solution in the Debug/Release directory beside the .exe/.dll it will create .tlb files, now you need to register to the GAC, go to Start-->run and write:
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\regasm "YourPath"\YourDll.dll /codebase tlb:"YourPath"\YourDll.tlb /verbose
now you can use the CreateObject from VBA to intatiate and you the assembly.

PS. you have to register ALL dlls.
Hope that helped.
Nassos

"Success is the ability to go from one failure to another with no loss of enthusiasm."
Winston Churchill

"Quality means doing it right when no one is looking."
Henry Ford

I've been trying to find a way to authenticate a user for a little chat application (VOIP, something like Teamspeak) I'm building. I've tried WMI (compatibility issues with older versions of Windows), and some non-managed C++ code. I want to use this as an identification and authentication system, one of which that requires absolutely no passwords. If a user has a unique ID or something on their own computer that I could get that always is the same, even after a format, something that no other person could have, etc. Any ideas on how to go about this other than those stated above?

Why this?
I'm tired of using half baked ban systems (such as that of Ventrilo's) which only rid your server of the users until they change their IP, when I ban someone I want them to be as so, as in never to come back, I realize this is nearly (if not) impossible in this day and age, however there must be some way...

This has to work on Windows machines, preferably without any restrictions as far as Windows versions go.

Thanks for your ideas!

How about the MAC address of the NIC? They're supposed to be unique (although there are rumours that this isn't always the case), which would mean that anyone being banned from your system would need to get either another computer or NIC to continue abusing it.

"On one of my cards it said I had to find temperatures lower than -8. The numbers I uncovered were -6 and -7 so I thought I had won, and so did the woman in the shop. But when she scanned the card the machine said I hadn't.

"I phoned Camelot and they fobbed me off with some story that -6 is higher - not lower - than -8 but I'm not having it."
-Tina Farrell, a 23 year old thicky from Levenshulme, Manchester.

I use the MAC address too - this is the function I use. (The third "MacAddress" in the collection is the system's first MAC address, hence the count.)

public static string GetMAC()
        {
            string returnString = string.Empty;
            ManagementObjectSearcher query = null;
            ManagementObjectCollection queryCollection = null;
            try
            {
                query = new ManagementObjectSearcher("SELECT * FROM Win32_NetworkAdapterConfiguration");
                queryCollection = query.Get();
                int count = 0;
                foreach (ManagementObject mo in queryCollection)
                {
                    if (!(mo["MacAddress"] == null))
                    {
                        count++;
                        if (count == 3)
                        {
                            returnString = mo["MacAddress"].ToString();
                            mo.Dispose();
                            break;
                        }
                    }
                    mo.Dispose();
                }
                queryCollection.Dispose();
                query.Dispose();
            }
            catch
            {
            }
            return returnString;
        }

I found quite an ingenious method to go about this, it may not be the best but it almost guarantees uniqueness, and contains no WMI code. It basically checks a couple system files/folders creation dates and does some work with those.

Hi,

After many hours of searching, I've managed to get this working using the code below - but I'm wondering if anyone has any suggestions on improving it? I'm sure this is not as efficient as it could be!

Also - how do I go about locking the target file during the read and write?

#region Encryption
    class RijndaelEncrypt
    {
        public static void Encrypt(XmlDocument ThisDocument, string FullPath)
        {
            //Save XML to memory stream
            MemoryStream ms = new MemoryStream();
            ThisDocument.Save(ms);
            //Convert memory stream to byte array
            byte[] xmlArray = ms.ToArray();
            //Encrypt
            RijndaelManaged Rij = new RijndaelManaged();
            Rij.Key = ASCIIEncoding.ASCII.GetBytes(Constants.Misc.MyKey); //MyKey is 16 character string
            Rij.IV = ASCIIEncoding.ASCII.GetBytes(Constants.Misc.MyKey);
            ICryptoTransform rijEncrypt = Rij.CreateEncryptor();
            byte[] encryptedData = rijEncrypt.TransformFinalBlock(xmlArray, 0, xmlArray.Length);
            //Create file stream and write encrypted data
            FileStream fsout = new FileStream(FullPath, FileMode.Create);
            fsout.Write(encryptedData, 0, encryptedData.Length);
            fsout.Close();
        }

        public static XmlDocument Decrypt(string FullPath)
        {
            //Create file stream and get file length
            FileStream fsin = new FileStream(FullPath, FileMode.Open, FileAccess.Read);
            FileInfo finfo = new FileInfo(FullPath);
            //Create binary reader and read from file stream
            BinaryReader br = new BinaryReader(fsin);
            //Decrypt
            byte[] encryptedData = br.ReadBytes((int)finfo.Length);
            RijndaelManaged Rij = new RijndaelManaged();
            Rij.Key = ASCIIEncoding.ASCII.GetBytes(Constants.Misc.MyKey);
            Rij.IV = ASCIIEncoding.ASCII.GetBytes(Constants.Misc.MyKey);
            ICryptoTransform rijDecrypt = Rij.CreateDecryptor();
            byte[] decryptedData = rijDecrypt.TransformFinalBlock(encryptedData, 0, encryptedData.Length);
            //Create XML document, fill with decrypted data and return the document
            XmlDocument ThisDocument = new XmlDocument();
            ThisDocument.LoadXml(Encoding.UTF8.GetString(decryptedData));
            return ThisDocument;
        }
    }
    #endregion

DaveyM69 wrote:
if anyone has any suggestions on improving it?

Perhaps you have an alternate reason for using encryption but maybe one improvement would be to provide some level of security?

Security is the reason for the encryption. The application has to store customer data (xml format) localy. To comply with data protection laws (United Kingdom) I have to encrypt this data. The only way to access it is through my application - which requires the user to supply a valid user name and password before the data can be seen.

I'm really looking for code/performance improvements as it just seems a little clumsy as it is.

Use the CryptoStream library class. If you want the data to be really secure use the Users password to encrypt the data that way programmers can't even get to it.

Need a C# Consultant? I'm available.

Happiness in intelligent people is the rarest thing I know. -- Ernest Hemingway

Thankyou! CryptoStream - I spent at least six hours trying to find something like that before ending up with the code I posted Laugh | :laugh:

I was going to ask last night but I was determined to experiment first, but at least i learned a few things along the way.

Thanks for your help - back to coding now Big Grin | :-D

Cryptographic libraries only provide algorithm implementations. To actually provide security you are still left to determine key management strategies based on your projects requirements.

I ended up with this - a slight variation on the examle given in MSDN.

class CryptoStreamEncryption
    {
        private static byte[] Key = ASCIIEncoding.ASCII.GetBytes(Constants.Misc.MyKey);
        private static byte[] IV = ASCIIEncoding.ASCII.GetBytes(Constants.Misc.MyKey);

        public static void Encrypt(XmlDocument ThisDocument, string FullPath)
        {
            try
            {
                FileStream fStream = File.Open(FullPath, FileMode.Create);
                Rijndael RijndaelAlg = Rijndael.Create();
                CryptoStream cStream = new CryptoStream(fStream, RijndaelAlg.CreateEncryptor(Key, IV), CryptoStreamMode.Write);
                StreamWriter sWriter = new StreamWriter(cStream);
                try
                {
                    sWriter.WriteLine(ThisDocument.OuterXml);
                }
                catch (Exception e)
                {
                    Console.WriteLine("An error occurred: {0}", e.Message);
                }
                finally
                {
                    sWriter.Close();
                    cStream.Close();
                    fStream.Close();
                }
            }
            catch (CryptographicException e)
            {
                Console.WriteLine("A Cryptographic error occurred: {0}", e.Message);
            }
            catch (UnauthorizedAccessException e)
            {
                Console.WriteLine("A file error occurred: {0}", e.Message);
            }

        }

        public static XmlDocument Decrypt(string FullPath)
        {
            XmlDocument ThisDocument = new XmlDocument();
            string val = null;
            try
            {
                FileStream fStream = File.Open(FullPath, FileMode.Open);
                Rijndael RijndaelAlg = Rijndael.Create();
                CryptoStream cStream = new CryptoStream(fStream, RijndaelAlg.CreateDecryptor(Key, IV), CryptoStreamMode.Read);
                StreamReader sReader = new StreamReader(cStream);
                try
                {
                    val = sReader.ReadLine();
                }
                catch (Exception e)
                {
                    Console.WriteLine("An error occurred: {0}", e.Message);
                }
                finally
                {
                    sReader.Close();
                    cStream.Close();
                    fStream.Close();
                }
            }
            catch (CryptographicException e)
            {
                Console.WriteLine("A Cryptographic error occurred: {0}", e.Message);
            }
            catch (UnauthorizedAccessException e)
            {
                Console.WriteLine("A file error occurred: {0}", e.Message);
            }
            catch (System.IO.FileLoadException e)
            {
                Console.WriteLine("A file load error occurred: {0}", e.Message);
            }
            catch (System.IO.FileNotFoundException e)
            {
                Console.WriteLine("A file not found error occurred: {0}", e.Message);
            }
            if (!(val == null))
            {
                ThisDocument.LoadXml(val);
            }
            return ThisDocument;
        }
    }

This is close to the other method I was going to suggest, so now I don't have to type it! I will, however, reiterate that key storage is essential to security, and simply including it in the compiled dll is NOT secure. Since it looks like you are doing this, I will reiterate (original warning came from one of the MVP's) that encrypting data does not imply security. You MUST have a way to secure the key from being read by another party for the encryption above to be secure. This is part of the key management strategy, and I encourage you to research it via the web to get ideas.

-Jeff

Hi Jeff,

Yeah - I did take your point on board, but getting the encryption/decryption working/performing optimally was my priority at that point.

The key storage is a bit of a problem as the encrypted data is stored on a network share with many clients needing access it (the reason for the filelock question) so they all need to know the key!

I thought maybe using the assembly's GUID with a little hashing as an extra layer may be a solution but I've been strugglig to get the GUID within code.

Any suggestions?

OK, this is an entirely incorrect way to go about this. You should NEVER require the users to know the key to encrypt/decrypt data. This leads to software upgrade nightmares, as key management is nearly impossible. What you should do is have a SINGLE web application (or a few for redundancy)that can get and decrypt the data, then return the decrypted data to the client (or re-encrypt it on the fly with a session key, if you want it to be secure). Hard-coding keys into client apps is a bad idea, as one key leak is detrimental to the entire system. On the other hand, with a single web app, changing the key after a known leak is easy, as you have control over both the data and the web app. Just a suggestion, but if you do implement the web app method, you could make it run as a specific user, so again, you could encrypt/decrypt on a user level, which alleviates you from having to manage the crypto key, as explained in earlier posts. Hope this helps,

-Jeff

The users do not need to know the key - only the application instances. They may only have network access and not internet so a web app is not an option so I think I'm stuck with hard coding it in some way but hopefully well obscured within the app.

I don't think you need to be "online" to connect to a web service. If you use a local computer, the address gets resolved within your own network (I think, but you could test this by disconnecting from the internet and seeing if you can still access other computers on your network). Again, I will reiterate that giving multiple users knowledge of the key makes the key more accessible and therefore, less secure. Anyway, to get the GUID of the assembly you can just do the following:

using System.Reflection;
using System.Runtime.InteropServices;
...
object[] res = Assembly.GetExecutingAssembly().GetCustomAttributes(typeof(GuidAttribute), true);
string guid = null;
if (res.Length > 0)
    guid = ((GuidAttribute)res[0]).Value;

Hope this helps,

-Jeff

That's helped alot Jeff,

Many thanks.

If you are using NTFS, do the following (adding try/catch as appropriate):

public static void Encrypt(XmlDocument ThisDocument, string targetFile) {
    FileStream outFile = new FileStream(targetFile, FileMode.OpenOrCreate, FileAccess
        .Write, FileShare.None, 0x1000, FileOptions.Encrypted| FileOptions.SequentialScan);
    ThisDocument.Save(outFile);
    outFile.Close();
}
public static XmlDocument Decrypt(string sourceFile) {
    FileStream inFile = new FileStream(sourceFile, FileMode.Open, FileAccess
        .Read, FileShare.None, 0x1000, FileOptions.Encrypted | FileOptions.SequentialScan);
    ThisDocument.Save(outFile);
    inFile.Close();
}

I am currently tired of typing, but I will explain how to do it another way in a bit, in case you are not using NTFS.

-Jeff

Isn't that user specific?

Need a C# Consultant? I'm available.

Happiness in intelligent people is the rarest thing I know. -- Ernest Hemingway

Yes, it is user specific... I suggested this because a previous post suggested that the user's password should be used as the key, which would also make it user specific.

-Jeff

There will be many users accessing this so this isn't viable unfortunately. Thanks for the suggestion though.

G'day,

A little while back I ran into a similar problem of storing data in a XML file which needs to be encrypted/decrypted as required. I found that using the Cryptography Application Block from Enterprise Library very useful. Purely because I could generate the symmetric key file specific to the user's credential's or machine config. Also you need to consider what happens to the encrypted/decrypted data memory once you have finished with it as well.

I can post some code if you are unfamiliar with the Cryptography Application Block.

To lock a file during Read/Write there is a class within .net that allows you do it. It escapes my mind right now.

cheers,
V