0
$\begingroup$

Our company would like to update our .Net apps so that they can run on Windows machines that require FIPS compliance. Currently we are using the System.Security.Cryptography.Rijndael class. I changed our encryption methods to use Cryptography.Aes instead and our apps are able to run on machines with FIPS compliance enabled and appear to function exactly the same.

That seems too easy. So my question is: are there any side effects to switching to AES that aren't readily apparent? Or does the encryption method not matter as long as the inputs and outputs are the same?

Improve this question
$\endgroup$
3
$\begingroup$

are there any side effects to switching to AES that aren't readily apparent?

  • Key sizes: AES is only defined for 128, 192, and 256 bit keys. Rijndael supports other key sizes. There is not much benefit to using the key sizes in between these two, but if you use AES they will not be available anymore.

  • Block size: Rijndael allows a wider range block sizes than AES

  • Performance: Using AES could lead to (notable) performance increases. Modern CPUs support a hardware instruction for evaluating AES that will be significantly faster than a software implementation. This will be dependent on the machine that is executing the code, as well as the implementation.

Or does the encryption method not matter as long as the inputs and outputs are the same?

The encryption method very much does matter. Different ciphers are not compatible with each other.

AES and Rijndael are not different ciphers per se. AES is the title given to the standardized variants of Rijndael.

Improve this answer
$\endgroup$
  • 1
    $\begingroup$ Also block size; Rijndael allows a wider range block sizes than AES (which can handle any block size you want, as long as you want 128 bits :-) $\endgroup$ – poncho Dec 20 '18 at 21:42
  • $\begingroup$ Thanks Ella, we'll take those into consideration. Our key size is 128. Also, we're not encrypting tons of data, just a few checks at login and a few other places, so I'm not too worried about the performance impact. $\endgroup$ – jascur2 Dec 20 '18 at 22:03
  • 1
    $\begingroup$ In any case, note that Ella indicated that switching to AES can improve performance - not decrease it. The worst which could happen would be no increase in performance, but there is no risk of any performance loss. $\endgroup$ – Geoffroy Couteau Dec 20 '18 at 23:51
  • $\begingroup$ If 140-2 certification is an issue, make sure that switching to AES does not invalidate your crypto modules' certificate. $\endgroup$ – outer May 3 '19 at 22:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.