My question rather splits into two sections:

  • Is AES correctly and security implemented in the .net Framework?

    Are there any reviews of implementation mistakes that would weaken the security of AES (e.g. against timing attacks)?

  • Error-checking with hash-then-encrypt

    I have a file i wish to transmit (encrypted), and would like to confirm that decryption was successful. To do this, I plan to take a hash of the file, append it to the file, then encrypt this. After decrypting, the receiver can re-calculate the hash, and compare it to the value I sent over.

    Is there a better way to check the decryption was correct?

  • $\begingroup$ Your question is pretty vague. What kind of weakness in .net's AES are you looking for? Timing attacks? I wouldn't worry too much about problems with .net's library itself, but rather about your code using it. The bad API makes it hard to write secure encryption in .net. Your second question is even more vague, you didn't really describe your scheme. But it's probably not secure. There are several related questions, such as "Non-cryptographic hash function as MAC for stream ciphers". $\endgroup$ Feb 3, 2013 at 14:27


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.