Re: secret key string visible in dll
From: Joe Kaplan \(MVP - ADSI\) (joseph.e.kaplan_at_removethis.accenture.com)
Date: 04/28/04
- Next message: Sara rafiee: "convert to dll in vb.net (webapplication)"
- Previous message: Sara rafiee: "Re: change password in active directory by webapplication (vb.net)"
- In reply to: Tim Mackey: "secret key string visible in dll"
- Next in thread: Tim Mackey: "Re: secret key string visible in dll"
- Reply: Tim Mackey: "Re: secret key string visible in dll"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Tue, 27 Apr 2004 22:34:32 -0500
With a tool like Reflector or Anakrino, it would be trivially easy to
decompile your assembly to discover how you are getting the key if it is
hard coded in the assembly. However, if you can protect access to the
assembly, then this may still be safe. It really depends on who will have
access to it.
Storing secrets is a very hard problem
Joe K.
"Tim Mackey" <anonymous@discussions.microsoft.com> wrote in message
news:7A875CEA-DD4E-4DB8-8397-3D6FC41F06AC@microsoft.com...
> hi,
> i am using 3des encryption with a secret key to send information between 2
aspnet applications. they both know the key, which is a hard-coded string.
i have read about using aspnet-setreg to securely store such a value in the
registry, but i have a different query.
> if i open the dll in notepad, i can read the secret key, which obviously
is no good. i tried changing the code to use a number as the secret key,
calling .ToString() on the number. I then recompile and open up the dll in
notepad and i can't find the number, which seems better. i don't know a
thing about disassembling .net executables, so i'd like to know if the key
is safe, hard-coded in the dll, in numeric form?
>
> granted a numeric key has less combinations than a string version, but
adding more digits will go some of the way to help that.
>
> thanks for any help
> tim mackey.
- Next message: Sara rafiee: "convert to dll in vb.net (webapplication)"
- Previous message: Sara rafiee: "Re: change password in active directory by webapplication (vb.net)"
- In reply to: Tim Mackey: "secret key string visible in dll"
- Next in thread: Tim Mackey: "Re: secret key string visible in dll"
- Reply: Tim Mackey: "Re: secret key string visible in dll"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
