Re: Security question - C# Discussion Boards

17-Feb-03 15:22

i noticed that the default size for des is 8 char's is it possible for me to change this to be anything between 8 and 16 charcters ?
i have tryed just sending a password more then 8 char's and i get a error stating that the password is not a valid size for this algorthim

Jesse M.

The Code Project Is Your Friend...

Furty17-Feb-03 17:01

17-Feb-03 17:01

The DES algorithm supports only 64 bit (actually, 56 bit but that's a whole other story) keys. If you're wanting stronger encryption look at some of the other crypto providers in the .Net framework:

RC2 supports 128 bit keys
Triple DES supports 192 bit keys (actually not 192 bit..)
Rijndael supports 128, 192 and 256 bit keys.

The reality is that DES is so easy to break you may as well not encrypt your data at all - I would never suggest using it.

Refer to my post in the next thread re: generating a key from a string password if you're not sure on how to do this.

jtmtv1817-Feb-03 19:31

17-Feb-03 19:31

i implemented it the way that you said..and it works fine but when ever i make the password anything over 8 (including 16) char's i get a IV.Key not valid for block size exception.... code is

DESCryptoServiceProvider des = new DESCryptoServiceProvider(); <br />
					byte[] prndKey = new byte[KeySecretString.Length];<br />
					PasswordDeriveBytes db = new PasswordDeriveBytes(KeySecretString,prndKey);<br />
					byte[] f= db.GetBytes(16);

The Code Project Is Your Friend...

Furty18-Feb-03 9:40

18-Feb-03 9:40

The idea is to generate a key that's the correct length for the crypto provider -the length of the key has nothing to do with the length of your password string.

Here's some sample code to get you up and running:

SymmetricAlgorithm sa = new DESCryptoServiceProvider();<br />
PasswordDeriveBytes pdb = new PasswordDeriveBytes(pwd, saltBytes);<br />
sa.Key = pdb.GetBytes(sa.LegalKeySizes[0].MaxSize / 8);

SaltBytes is a byte[] array you must supply first. the Salt bytes must be the same for encryption as well as decryption, and are used to help strengthen weak passwords. You may want to a simple fixed array:
byte[] saltBytes = new byte[]{0x00, 0x74, 0xBa etc etc.. };
Or, ideally you would use the RNG service provider the create a random salt for every enceryption, and store the salt value somewhere in the encrypted stream so it could be read when decrypting.

Perhaps I should put together and article on proper cryptography in .Net?

jtmtv1818-Feb-03 12:10

18-Feb-03 12:10

yeah i think you should i would deffinitly like to read it.

The Code Project Is Your Friend...

Security question

Omega50117-Feb-03 13:30

Omega501

17-Feb-03 13:30

I'm looking at writing an app for storing passwords for the different mailing lists i'm on, with the data encrypted and stored in an xml file. I was wondering if there is a way (in c#) to get a password from a user, and use that as the key to decrypt the data.

I've looked (briefly) through the System.Security.Cryptography namespace but it seems to mostly deal with keys (seperate files), but I would much prefer to input a password and use that as the decryption key - is this possible?

jtmtv1817-Feb-03 13:46

17-Feb-03 13:46

this is what i use in my program to encrypt hole files. you can possibly use it for yours as well;

inName = full path of the file to be encrypted(this file is only opened and not deleted...you will have to rewrite that part)

outName : output...encrypted file

KeySecretString (the password to encrypt with)

to decrypt the file use the same code but replace :
CryptoStream encStream = new CryptoStream(fout, tdes.CreateEncryptor(tdes.Key, tdes.IV), CryptoStreamMode.Write);
with :
CryptoStream encStream = new CryptoStream(fout, tdes.CreateDecryptor(tdes.Key, tdes.IV), CryptoStreamMode.Write);

further more where you see the code DESCryptoServiceProvider des = new DESCryptoServiceProvider(); you can replace the DES part with RC2 to get RC2 encryption / decryption instead.

Happy Coding...

Jesse M

<br />
private void DecryptData(String inName, String outName, string KeySecretString)<br />
			 {  <br />
				    //Create the file streams to handle the input and output files.<br />
				    FileStream fin = new FileStream(inName, FileMode.Open, FileAccess.Read);<br />
				    FileStream fout = new FileStream(outName, FileMode.OpenOrCreate, FileAccess.Write);<br />
				    fout.SetLength(0);<br />
					string FileN = Path.GetFileName(outName);<br />
					InformationFile.Text = FileN;<br />
					InformationFile.Update();<br />
				    //Create variables to help with read and write.<br />
				    byte[] bin = new byte[buffersize]; //This is intermediate storage for the encryption.<br />
				    long rdlen = 0;              //This is the total number of bytes written.<br />
				    long totlen = fin.Length;    //This is the total length of the input file.<br />
				    int len;                     //This is the number of bytes to be written at a time.<br />
DESCryptoServiceProvider tdes = new DESCryptoServiceProvider(); <br />
					tdes.IV = ASCIIEncoding.ASCII.GetBytes(KeySecretString);			<br />
					tdes.Key =ASCIIEncoding.ASCII.GetBytes(KeySecretString);<br />
				    CryptoStream encStream = new CryptoStream(fout, tdes.CreateDecryptor(tdes.Key, tdes.IV), CryptoStreamMode.Write);        <br />
				    Console.WriteLine("Encrypting...");<br />
				    //Read from the input file, then encrypt and write to the output file.<br />
				    while(rdlen < totlen)<br />
				    {<br />
				        len = fin.Read(bin, 0, buffersize);<br />
				        encStream.Write(bin, 0, len);<br />
				        rdlen = rdlen + len;<br />
				        Console.WriteLine("{0} bytes processed", rdlen);<br />
<br />
				    }<br />
				   	fout.Flush();<br />
					fin.Flush();<br />
					encStream.Flush();<br />
				    encStream.Close();<br />
					fout.Close();<br />
					fin.Close();<br />
					return;<br />
				} <br />

The Code Project Is Your Friend...

Omega50117-Feb-03 14:07

Omega501

17-Feb-03 14:07

The code looks interesting, I might be able to modify it to what I want. Instead of encrypting the whole file though, all I want to do is encrypt the data in the xml file.

jtmtv1817-Feb-03 14:16

17-Feb-03 14:16

im not gonna post the code agian...but the code utilized a file stream(inName)....you can save the xml file then encrypt it..but the problem is..for the millisecond that the file is saved on the hd and encryption hasnt got to it it is open. but you might beable to swap the FileStream with the XMLWriter (cant remeber the exsact name for it) try it..and the encryption stream might work fine with a xml stream ..... happy coding.

Jesse M

The Code Project Is Your Friend...

Omega50117-Feb-03 15:21

Omega501

17-Feb-03 15:21

Thanks fror your help - in this instance security isn't that high a priority - I'm only writing this for myself as an experiment

Furty17-Feb-03 16:55

Reading Files From Offset

17-Feb-03 16:55

This is something I see implemented incorrectly time and time again. The *correct* way to derive a key from a string password is using the System.Security.Cryptography.PasswordDeriveBytes method - it's usage is very straight forward.

afronaut17-Feb-03 13:19

afronaut

17-Feb-03 13:19

Hello all -

I'm trying to write some code to read ID3 tags from mp3 files. ID3 stores information at *the end* of the mp3 file in 128 bytes.

I want to avoid having to loop through the entire file to get the data that I need but it appears that one only can read from the beginning of a file using the .NET I/O classes.

Is it possible to call a version of a Read method with an offset specifying where in a file you want to start reading into a byte array?

eg:
string path = "c:\\downers\\Mancini.mp3";
FileInfo fi = new FileInfo(path);
// the file length
long len = fi.Length;
// subtract 128
long start= len - 128;
int st = (int)start;
Stream fis = File.Open(path,FileMode.Open, FileAccess.Read);
BinaryReader re = new BinaryReader(fis);
byte[] data = new byte[128];
re.Read(data, start, 128); // this won't work, but you get my intuitions...

This doesn't work though; the offset argument in the middle of the read method is an offset in the byte array to start on.

Any ideas? Am I missing something obvious? Otherwise I just have code that loops through the entire file a byte at a time. Cry | :((

*->>Always working on my game, teach me
*->>something new.
cout << "dav1d\n";

Xpander17-Feb-03 16:14

Xpander

17-Feb-03 16:14

FileStream Mp3Stream = new FileStream(mp3File, FileMode.Open, FileAccess.Read);

Mp3Stream.Seek(-128, SeekOrigin.End);

Wesner Moise17-Feb-03 16:21

Wesner Moise

17-Feb-03 16:21

Why is your code so long? Remember you can do most things with few lines of code.

You probably want something like this.

FileStream f = File.OpenRead("x");
f.Seek(-128, SeekOrigin.End);
f.Read(bytearray, 0, 128);
f.Close();

Also, you can get the length of the file just with f.Length;

Forget about using BinaryReader, David; it's for smart people. It allows you read/write different types like doubles, integers instead of working with bytes.

Thanks,
Wes

afronaut18-Feb-03 2:43

afronaut

18-Feb-03 2:43

Thanks Wes,

very helpful. I 'discovered' seek a few minutes after posting Blush | :O

My code was a bit more lengthy because I was still feeling my way around the problem. Like usual, I should have cleaned up a bit before posting...

*->>Always working on my game, teach me
*->>something new.
cout << "dav1d\n";

Furty17-Feb-03 17:05