C # AES Algorithm - Where and How to Store the Key and IV

I use the AES algorithm to encrypt and decrypt a password when PasswordFormat is encrypted for asp.net. If the format were Hashed, I would generate a unique salting value for each password and save it in the column of the table in which the password is stored. But for encryption, this is different, what I worry about below

1

If I create a unique IV , Key for each password, then I have to support them somewhere. Is this the right security approach?

2

If I have HardCode IV and Key in the application configuration ( web.config ), then I have to worry about what happens when any of the above pairs change? How should I deal with this situation?

3

Give me your ideas on what I should do. I will put them here :)

+4
source share
1 answer

Answers:

  • No, there is no need for a unique key for each password - and this will not be useful, since your key must be stored somewhere. You can also save a password in this secure system.

  • You do not have to store the key on the same system with the same access conditions as the password. This would make encrypted storage useless. You must put the key in a different place, protected from abuse, and perform encryption inside this system.

You are much better off picking a feature like PBKDF2 and save the result of this. Key management is a complex task and should not be chosen without a good idea of ​​how to proceed (hire a professional if you go like that).

Finally, the whole idea of ​​IV is that it protects plain text when the same key is used. You can set the value of IV to all zero if you have a key for one text / encryption text pair. However, the idea is that you use one key, which is stored somewhere with preservation, and a random IV, stored using encrypted text.

As already mentioned, if you did not already know this, your circuit is unsafe because there are many other things that you can consider, and you probably did not.

PS Microsoft has several ways to securely store keys in the system, for this you may need to search for stackoverflow. However, I am not an expert on the MS API.

+2
source

Source: https://habr.com/ru/post/1393935/


All Articles