Currently, I'm using a static IV value for all encryption and decryption but I would like it to be dynamic for each encyption/decryption request so I started using new byte[16] and it works. The problem is how to detect and decrypt old data. Below is my code to decrypt and I'm passing static IV stored on a secret in keyvault.
private static byte[] DecryptFromBytes_Aes(byte[] dataBytes, byte[] key, byte[] iV)
{
if (dataBytes == null || dataBytes.Length <= 0)
throw new ArgumentNullException("DataBytes");
if (key == null || key.Length <= 0)
throw new ArgumentNullException("key");
if (iV == null || iV.Length <= 0)
throw new ArgumentNullException("iV");
byte[] result = null;
using (AesCryptoServiceProvider aesAlg = new AesCryptoServiceProvider())
{
aesAlg.Key = key;
aesAlg.IV = iV;
aesAlg.Padding = PaddingMode.PKCS7;
ICryptoTransform decryptor = aesAlg.CreateDecryptor(aesAlg.Key, aesAlg.IV);
using (MemoryStream memoryStream = new MemoryStream(dataBytes))
{
using (CryptoStream cryptoStream = new CryptoStream(memoryStream, decryptor, CryptoStreamMode.Read))
{
byte[] decryptedBytes = new byte[dataBytes.Length];
int read = cryptoStream.Read(decryptedBytes, 0, dataBytes.Length);
Array.Resize(ref decryptedBytes, read);
result = decryptedBytes;
}
}
}
return result;
}