2
$\begingroup$

I am thinking about Rijndael implementation in order to store tokens (cannot be hashed) - one token for one user. And finally I get stuck with key/IV generation problem :(

The questions are:

1) Is there some difference between the solutions - which is more secure?

2) Do presented solutions have some weak side?

3) Suppose attacker has come to this page and now he knows the algorithm, does it help him a lot to decode passwords?

Solution 1 - counter in generator's input:

Rijndael rijndael = Rijndael.Create()
Rfc2898DeriveBytes pdb = new Rfc2898DeriveBytes(cipherTextBytes + **Counter**, SALT128b, 514);
rijndael.Key = pdb.GetBytes(32);
rijndael.IV = pdb.GetBytes(16);

Solution 2 - counter as IV:

Rijndael rijndael = Rijndael.Create()
Rfc2898DeriveBytes pdb = new Rfc2898DeriveBytes(cipherTextBytes, SALT128b, 514);
rijndael.Key = pdb.GetBytes(32);
rijndael.IV = **Counter**;

Where Counter is unique [0..N] int, cipherTextBytes - the same for every generation byte[200] array.

Both parts have the same end:

MemoryStream memoryStream = new MemoryStream();
CryptoStream cryptoStream = new CryptoStream(memoryStream, rijndael.CreateEncryptor(), CryptoStreamMode.Write);
cryptoStream.Write(passwdByteArray, 0, passwdByteArray.Length);
cryptoStream.Close();

Thank you in advance!

$\endgroup$
  • 1
    $\begingroup$ So many questions that need clarification: How (and why) do you intend to utilize a block cipher to store passwords? "Is there some difference between the solutions" - what solutions? What presented approaches? It is not at all clear what you are asking. $\endgroup$ – Ella Rose Mar 13 '17 at 1:25
  • $\begingroup$ "How and why" - they are not the passwords actually, sorry, they are tokens which cannot be hashed. I corrected description above. I intend to use SALT in code, password from user and cipherTextBytes from another source lets say from network server. So, suppose a code be stolen it has only SALT it should not help, if DB be stolen - it has just encrypted data, code + DB also nothing without cipherTextBytes. Solutions - these two parts of code with key /IV generation. I made description a bit more clarified! $\endgroup$ – KEMBL Mar 13 '17 at 1:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.