Blog | G5 Cyber Security

Secure Data in .NET: Symmetric Encryption

G5 Cyber Security

TL;DR

This guide shows you how to encrypt and decrypt data securely using symmetric encryption in your .NET applications. We’ll use the AES algorithm with a strong key, focusing on practical implementation for protecting sensitive information.

1. Choose an Encryption Algorithm

AES (Advanced Encryption Standard) is a widely used and secure symmetric encryption algorithm. .NET provides excellent support for it through the AesCryptoServiceProvider class.

2. Generate a Strong Key

The key is crucial! A weak key compromises the entire system. Use a cryptographically strong random number generator to create your key. The key size should be at least 128 bits (16 bytes), but 256 bits (32 bytes) is generally recommended for higher security.

using System.Security.Cryptography;

// Generate a 256-bit AES key
byte[] key = new byte[32];
using (var rng = RandomNumberGenerator.Create())
{
    rng.GetBytes(key);
}

3. Create an Initialization Vector (IV)

The IV adds randomness to the encryption process, even if you encrypt the same data multiple times with the same key. It must be unique for each encryption operation. Use a random number generator like in step 2 and ensure it’s the correct size for your chosen cipher block size (typically 16 bytes for AES).

// Generate a 16-byte IV
byte[] iv = new byte[16];
using (var rng = RandomNumberGenerator.Create())
{
    rng.GetBytes(iv);
}

4. Encryption Process

  1. Instantiate the AES CryptoServiceProvider: Create an instance of AesCryptoServiceProvider.
  2. Set Key and IV: Configure the crypto service provider with your generated key and IV.
  3. Create a Cipher Stream: Use a MemoryStream to hold the encrypted data. A CryptoStream will handle the encryption process.
  4. Write Data to the CryptoStream: Write the plaintext data into the CryptoStream, which encrypts it on-the-fly.
  5. Retrieve Encrypted Data: Read the encrypted bytes from the MemoryStream.
using System.IO;

public static byte[] Encrypt(byte[] plaintext, byte[] key, byte[] iv)
{
    using (var aes = new AesCryptoServiceProvider())
    {
        aes.Key = key;
        aes.IV = iv;

        using (var memoryStream = new MemoryStream())
        using (var cryptoStream = new CryptoStream(memoryStream, aes.CreateEncryptor(), CryptoStreamMode.Write))
        {
            cryptoStream.Write(plaintext, 0, plaintext.Length);
            cryptoStream.FlushFinalBlock();
            return memoryStream.ToArray();
        }
    }
}

5. Decryption Process

  1. Instantiate the AES CryptoServiceProvider: Create an instance of AesCryptoServiceProvider.
  2. Set Key and IV: Configure with the *same* key and IV used for encryption.
  3. Create a Cipher Stream: Use a MemoryStream to hold the decrypted data, and a CryptoStream for decryption.
  4. Write Encrypted Data to CryptoStream: Write the ciphertext into the CryptoStream, which decrypts it on-the-fly.
  5. Retrieve Decrypted Data: Read the plaintext bytes from the MemoryStream.
public static byte[] Decrypt(byte[] ciphertext, byte[] key, byte[] iv)
{
    using (var aes = new AesCryptoServiceProvider())
    {
        aes.Key = key;
        aes.IV = iv;

        using (var memoryStream = new MemoryStream())
        using (var cryptoStream = new CryptoStream(memoryStream, aes.CreateDecryptor(), CryptoStreamMode.Write))
        {
            cryptoStream.Write(ciphertext, 0, ciphertext.Length);
            cryptoStream.FlushFinalBlock();
            return memoryStream.ToArray();
        }
    }
}

6. Important Considerations

Exit mobile version