Re: Asymmetric encryption questions

From: Chad Myers (cmyers@N0.S.P4.M.austin.rr.com)
Date: 06/20/02 

From: "Chad Myers" <cmyers@N0.S.P4.M.austin.rr.com>
Date: Thu, 20 Jun 2002 09:57:44 -0500

"Ollie" <ollie.riches@hotmail.com> wrote in message
news:OrpVxkGGCHA.2424@tkmsftngp10...
> Chad,
>
> Ii was not thinking of making a secure channel to pass data down the wire
or
> to another process, but since you mentioned is this how it is 'meant' to
be
> done?

Ollie,

What I was explaining is how to establish a TripleDES session
between two peers on an unsafe network (the Internet) safely.

What are you trying to do?

-c

>
> "Chad Myers" <cmyers@N0.S.P4.M.austin.rr.com> wrote in message
> news:#qz0SXGGCHA.1744@tkmsftngp13...
> >
> > "FullMetalAnorak" <ollie.riches@hotmail.com> wrote in message
> > news:eKOkYLEGCHA.2544@tkmsftngp08...
> > > Hi,
> > >
> > > I want to use public, private key encryption so after looking at the
> help
> > I
> > > am going to use RSACryptoProvider, I see that if I want to serialize
out
> > the
> > > public, private keys I use the method 'ExportParameters' that returns
> the
> > > RSAParameters object which can be serialized as XML.
> > >
> > > Does this contain all the information required to recreate an
> > > RSACryptoProvider?
> >
> > Yes.
> >
> > >
> > > Does this contain both the public and private keys?
> >
> > It always contains the public, but the "exportPrivateData" flag
> > on the ExportParameters() method determines whether it exports
> > the private key.
> >
> > >
> > > Do I need to extract out the public key for my client or just provide
> all
> > > the information from the serialized object?
> > >
> > > Can you persist the keys generated in the RSACryptoProvider?
> >
> > Yes. You can write the bytes or xml to a file, however, storing private
> > key data is a bad practice unless you do so according to key storage
> > standards.
> >
> > .NET has no managed support for secure key storage. You must use
> > the unmanaged Win32 CryptoAPI methods for storing keys securely.
> >
> > What I think you're looking to do is do key exchange. If you want
> > to create an encrypted session, you should generate a keypair
> > on the server, then use something like RSAOAEPKeyExchangeFormatter
> > and Deformatter to properly send the server's public key to the
> > client. Then, using that new RSA encrypted channel, you can send
> > the session key for your TripleDES (or other symmetric alg)
> > encryption session.
> >
> > It's not a good idea to use RSA to do full encryption as its
> > slower than symmetric algorithms such as TripleDES or Rijndael.
> >
> > -c
> >
> >
>
>

Relevant Pages

  • RE: PGP scripting...
    ... cryptosystems, ... In these systems divulging your private key compromises the public ... Here is a quick over view of the public key encryption routines (the ...
    (SecProg)
  • Re: RSACryptoServiceProvider decrypt with public key
    ... private key which my programs could decipher using a public key I've ... But since private key encryption and public key decryption isn't ... > If Alice gives Bob her public key, ...
    (microsoft.public.dotnet.security)
  • RE: PGP scripting...
    ... that you keep the private key secret. ... Here is a quick over view of the public key encryption routines (the ... Since only he, through the use of his private key, can decrypt the ...
    (SecProg)
  • RE: PGP scripting...
    ... In addition to being confused about arbitrary asymmetry in RSA cryptography ... Microsoft .NET, for example, defines a private key as inclusive of its ... .NET Framework includes the public key. ... As for encryption speed, encryption transformations with a public key ...
    (SecProg)
  • Re: Asymmetric encryption questions
    ... >> I want to use public, private key encryption so after looking at the ... private keys I use the method 'ExportParameters' that returns ... > .NET has no managed support for secure key storage. ...
    (microsoft.public.dotnet.framework.aspnet.security)