Re: How to encrypt/decrypt a file

Hello,

I think the OP simply wants to encrypt the xml file to prevent the clients
to edit the clear-text xml files.

A symetric key is useful here. One could use the DPAPI (ProtectedData class
in .NET 2.0). Because the scenario is in a ASP.NET environment, a
machine-wide scope must be used with that API, so anyone running on the same
machine under the same account could decrypt the files. But the clients
could not decrypt it.

Another approach is to create a symetric key and store it somewhere, like a
file or a database table. The storage must then be secured properly by a
strong ACL. So, no bulletproof solution.

I would stick to the ProtectedData API.

Greetings,
Henning

"Mitch Gallant" <jensigner@xxxxxxxxxxxxxxxx> wrote in message
news:eLLw0HoMGHA.1124@xxxxxxxxxxxxxxxxxxxxxxx
That's good! You are then talking about "enveloping" data to the
server.
The OP if I understand correctly, wanted the file to be encrypted to
each client .. which of course is not addressed by enveloping back to the
server.
If data protection on the wire is important to may users, than SSL makes
sense,
potentially with end-user authentication (i.e. possibly user-certificates
to validate users).
Perhaps the OP can clarify exactly what the requirements are.
- Mitch

"Eric Johnson" <ej@xxxxxxxxxxxxxxxxx> wrote in message
news:znLIf.53504$vO1.34889@xxxxxxxxxxxxxxxxxxxxxxxxx
Let me clarify... in the code I just completed, the client is actually
doing the encryption with the public key and the server decrypts with the
private. I misspoke when trying to explain with respect to the problem
Corey is working with.

Thanks for bringing that to my attention... Corey I apologize for the
misstatement.



Mitch Gallant wrote:
"Eric Johnson" <ej@xxxxxxxxxxxxxxxxx> wrote in message
news:qFJIf.22845$6Q3.17878@xxxxxxxxxxxxxxxxxxxxxxxxx
I'm new to this to, in fact I just got done with my first real use of
encryption and it doesn't sound too different from what you are running
into. Here's a little about what I ended up doing, hopefully it'll
help.

I created a public/private key pair (RSACryptoServiceProvider) that
gets stored in a Key Container on the server. The client is given the
public key so they can decrypt stuff the server encrypted with its
private key.


The public key should be considered exactly that .. PUBLIC ..
If you are expecting that the data is ENCRYPTED with the servers private
key, then this is poor security.
What you are doing (encrypting with servers private key .. decrypting
with
corresponding public key on the client) is what digital siganture
verification is about.
Public keys should be considered complely visible publically ..
therefore, the
encryption scheme you are using is not sure at all (even though you
might think
you are protecting the public key for your clients use only?)

- Mitch Gallant
MVP Security




.

Relevant Pages

  • RE: questions on setting up a mail server
    ... questions on setting up a mail server ... The first group does encryption of the password only. ... Sure it is simple - when ALL clients are running the same version ... of Windows, IE, and Outlook. ...
    (freebsd-questions)
  • Encrypting off-site with certificates public key
    ... I thought it would be wise to use a certificate encryption scheme to allow ... Then the data is written into a varbinarycolumn on the central server ... For some reason the public key is generating a different algorithm on .NET ...
    (microsoft.public.sqlserver.security)
  • Re: WSJ Online: Voltage Unveils Encryption Program
    ... > proposed what they called identity-based encryption. ... > person's e-mail address, for example, could act as a public key, avoiding ... Server A makes a private key for you. ... had used PGP instead and put that directly in Outlook [not as some ad ...
    (sci.crypt)
  • Re: How to encrypt/decrypt a file
    ... If the clients' don't need to decrypt the file at all, then either a server-side private key, ... I think the OP simply wants to encrypt the xml file to prevent the clients to edit the clear-text ... server. ... The client is given the public key so they can decrypt stuff the ...
    (microsoft.public.dotnet.security)
  • Re: Encryption keys
    ... In other words, since the public key is public, anyone can ... cert plus the time stamp on the server), ... > simple hash like SHA1or something, then it is pretty easy to brute ... >> SSL uses asymmetric encryption, ...
    (microsoft.public.dotnet.general)