Re: DP API Security queries

Hi Aachin,

The encryption key is, as you said, maintained by Windows. Depending on the
scope you are using (I assume you use machine, since you are in an ASP.NET
application), any process on that machine can decrypt that value. Thats why
you can pass along an array of bytes for additional security.


The other two questions have one answer: Base64. Just convert the byte array
you get to a BASE64 string, and you will have no problem at all (use
Convert.ToBase64String() method).

Greetings,
Henning


"Sachin Chavan" <sachinrchavan@xxxxxxxxxxxxxxxx> wrote in message
news:36FDD5EC-4C92-4395-9B50-5D44EC127230@xxxxxxxxxxxxxxxx
Hi,

In my application, I am using a .net wrapper class (a dll) which
internally
calls the Win32 DP API for encryption and decryption.

Now, my client has following queries:

1. Since the encryption Key is managed by Windows internally what is the
security of the Key used for encryption?

i.e. Microsoft can be able to access such keys and therefore, the
information is not secure.

2. What is the guarantee that the encrypted text thus generated won't
contain characters not supported by xml. This may create problem, if they
do
generate such characters, since we store them to web.config which is an
xml
file.

And,

3. What is the guarantee that the encrypted text thus generated won't
contain a double quote which denote end of the Value field in web.config.
If
it generates one, you will have a bad xml file.


Please help me, I am stuck up with this issues.

Thanks,
Sachin R. Chavan.


.

Relevant Pages

  • Re: Denied access to my encrypted files. HELP!
    ... That is what you need unless you backed up the encryption key or ... >>MS MVP (Security, Windows), MCDBA, MCSE both ... >>> the old hard drives with the data, ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Cant decrypt crypted files
    ... That someone should have kept a record of the encryption key. ... Well, of course it was ME to ask Windows to encrypt my files, and it was MY ... Looks also like this isn't the first time such a thing happened or there ...
    (microsoft.public.windowsxp.security_admin)
  • Re: if I encrypt key data why do I want or need SSL?
    ... If an attacker compromises your system somehow and gets your strong named ... he can simply decompile it. ... using asymetric encryption, you are rebuilding https... ... The encryption key itself - are you using one for all the encryption stuff? ...
    (microsoft.public.dotnet.security)
  • Re: My encrypt/decrypt algorithm...
    ... the only issue for the algorithmus actual strength. ... I'm not someone who woke up one morning, seen an encryption special on ... fact that the encryption key,, is random, ... amount of time needed to decrypt it would span generations. ...
    (sci.crypt)
  • Re: How good is W2K encryption
    ... Having an encryption key (certificate) doesn't mean you also have the ... decryption key. ...
    (microsoft.public.win2000.security)