Repository navigation
Random IV in encrypt data example - #21043
Conversation
There was a problem hiding this comment.
Hi @duracellko
This looks good, thank you. We'll 
when you make the suggested changes. Also, it is fine to use the C# 8 bits here - not a problem.
| The following example illustrates how to create a new instance of the default implementation class for the <xref:System.Security.Cryptography.Aes> algorithm. The instance is used to perform decryption on a <xref:System.Security.Cryptography.CryptoStream> object. This example first creates a new instance of the **Aes** implementation class. Next it creates a **CryptoStream** object and initializes it to the value of a managed stream called `myStream`. Next, the **CreateDecryptor** method from the **Aes** class is passed the same key and IV that was used for encryption and is then passed to the **CryptoStream** constructor. | ||
| The following example illustrates how to create a new instance of the default implementation class for the <xref:System.Security.Cryptography.Aes> algorithm. The instance is used to perform decryption on a <xref:System.Security.Cryptography.CryptoStream> object. This example first creates a new instance of the **Aes** implementation class. Next it reads IV value from a managed stream called `myStream`. Next it creates a **CryptoStream** object and initializes it to the value of the managed stream called `myStream`. Next, the **CreateDecryptor** method from the **Aes** class is passed the read IV and the same key that was used for encryption and are then passed to the **CryptoStream** constructor. | ||
|
|
||
| ```vb |
There was a problem hiding this comment.
If you're adding VB and C# code, all code examples must have functional equivalents. For example, this VB should have a C# equivalent - otherwise you end up with a mix of the two languages and the language dropdown doesn't work.
There was a problem hiding this comment.
Am I missing something? The C# code is just below the VB code. Or should C# code be always first?
I didn't change this part and in currently published version both languages work.
There was a problem hiding this comment.
My concern here is that when there is a snippet of VB, that needs to be immediately followed by C#. This is part of the language toggle on the platform, since this article has both VB and C#. Does that make sense?
There was a problem hiding this comment.
But this VB snippet is followed by C#.
Dim aes As Aes = Aes.Create()
Dim cryptStream As New CryptoStream(myStream, aes.CreateDecryptor(key, iv), CryptoStreamMode.Read)Aes aes = Aes.Create();
CryptoStream cryptStream = new CryptoStream(myStream, aes.CreateDecryptor(key, iv), CryptoStreamMode.Read);Unless we are talking about different snippet.
Co-authored-by: David Pine <david.pine@microsoft.com>
|
I have a question. Would this repository join Hacktoberfest by adding tag? https://hacktoberfest.digitalocean.com/hacktoberfest-update |
I'm actually not sure, let's ask @BillWagner about that. |
|
Closed and reopened to trigger build validation... odd happens 😵 |
Already since .NET 2 and MSDN lot of examples about symmetric cryptography treat IV the same way as encryption key. Unfortunately this anti-pattern is quite often used in production code too. Main purpose of IV is to add some randomness to encrypted data. So that encrypting the same text gives different output each time. This way an attacker cannot tell if the encrypted message/password is the same or not.
Therefore I updated Encrypting data and Decrypting data using AES pages. There are following changes:
usingstatement and notClosemethod.Open question: I used new
usingform in C# 8 without nested code block. Is this ok, or should the example be compatible with previous versions of C#?