I am thinking about Rijndael implementation in order to store tokens (cannot be hashed) - one token for one user. And finally I get stuck with key/IV generation problem :(
The questions are:
1) Is there some difference between the solutions - which is more secure?
2) Do presented solutions have some weak side?
3) Suppose attacker has come to this page and now he knows the algorithm, does it help him a lot to decode passwords?
Solution 1 - counter in generator's input:
Rijndael rijndael = Rijndael.Create() Rfc2898DeriveBytes pdb = new Rfc2898DeriveBytes(cipherTextBytes + **Counter**, SALT128b, 514); rijndael.Key = pdb.GetBytes(32); rijndael.IV = pdb.GetBytes(16);
Solution 2 - counter as IV:
Rijndael rijndael = Rijndael.Create() Rfc2898DeriveBytes pdb = new Rfc2898DeriveBytes(cipherTextBytes, SALT128b, 514); rijndael.Key = pdb.GetBytes(32); rijndael.IV = **Counter**;
Where Counter is unique [0..N] int, cipherTextBytes - the same for every generation byte array.
Both parts have the same end:
MemoryStream memoryStream = new MemoryStream(); CryptoStream cryptoStream = new CryptoStream(memoryStream, rijndael.CreateEncryptor(), CryptoStreamMode.Write); cryptoStream.Write(passwdByteArray, 0, passwdByteArray.Length); cryptoStream.Close();
Thank you in advance!