Groups | Blog | Home
all groups > asp.net security > september 2003 >

asp.net security : TripleDES Encryption issue



jdn
9/6/2003 2:29:31 AM
I'm new to using this part of the framework, so I'm hoping I've done
something obviously stupid, which someone will be able to point out in
an obvious manner.

Most of the samples I've seen involved encrypting and decrypting to and
from a file, but that's not what I want. I want to be able to insert a
string into an encryption function which outputs that encrypted string,
which could then be sent into a decryption function and spit out the
original string.

As you might expect, ultimately, I want to be able to put this string
into a database table.

Anyways, I set up a simple test page where I enter a string in a
textbox, and then run it through an encrypt, then decrypt, function, and
print out to some labels to make sure it is doing it correctly.

The encrypt part seems to work (at least the function doesn't fail), but
the decrypt function fails, with an error saying that the length of the
encrypted string is invalid. Here are the functions:

**************************************************************

public static string Encrypt(string StringToEncrypt){
string EncryptedString;
UTF8Encoding utf8encoder = new UTF8Encoding();
byte[] inputInBytes = utf8encoder.GetBytes(StringToEncrypt);
TripleDESCryptoServiceProvider tdesProvider = new
TripleDESCryptoServiceProvider();
ICryptoTransform cryptoTransform =
tdesProvider.CreateEncryptor(tdeskey, tdesIV);
MemoryStream encryptedStream = new MemoryStream();
CryptoStream cryptStream = new CryptoStream(encryptedStream,
cryptoTransform, CryptoStreamMode.Write);

cryptStream.Write(inputInBytes, 0, inputInBytes.Length);
cryptStream.FlushFinalBlock();
encryptedStream.Position = 0;

byte[] result = new byte[encryptedStream.Length - 1];
encryptedStream.Read(result, 0, (int)(encryptedStream.Length - 1));
cryptStream.Close();

UTF8Encoding myutf = new UTF8Encoding();
EncryptedString = myutf.GetString(result);
return EncryptedString;
}//end Encrypt

public static string Decrypt(string StringToDecrypt){
string DecryptedString;


UTF8Encoding utf8encoder = new UTF8Encoding();
byte[] inputInBytes = utf8encoder.GetBytes(StringToDecrypt);
TripleDESCryptoServiceProvider tdesProvider = new
TripleDESCryptoServiceProvider();
ICryptoTransform cryptoTransform =
tdesProvider.CreateDecryptor(tdeskey, tdesIV);
MemoryStream decryptedStream = new MemoryStream();
CryptoStream cryptStream = new CryptoStream(decryptedStream,
cryptoTransform, CryptoStreamMode.Write);

cryptStream.Write(inputInBytes, 0, (inputInBytes.Length));
cryptStream.FlushFinalBlock();
decryptedStream.Position = 0;

byte[] result = new byte[decryptedStream.Length - 1];
decryptedStream.Read(result, 0, (int)(decryptedStream.Length - 1));
cryptStream.Close();

DecryptedString = result.ToString();

return DecryptedString;
}//end Decrypt

************************************************************************

cryptStream.FlushFinalBlock() in the decrypt function is what fails.

Any ideas would be greatly welcomed.

jdn
kingcrim@earthlink.net
Cowboy (Gregory A Beamer)
9/6/2003 12:08:40 PM
Change the stream type. The encryption samples use a file stream, but any
type of stream can be used to encrypt/decrypt. I have seen plenty of samples
with strings, as well as files, but you are correct that many of the samples
are file based.

Hope this helps.

--
Gregory A. Beamer
MPV; MCP: +I, SE, SD, DBA

**********************************************************************
Think outside the box!
**********************************************************************
[quoted text, click to view]

jdn
9/6/2003 7:28:08 PM
[quoted text, click to view]

Change the stream type to what?

Thanks.

jdn
jdn
9/7/2003 4:15:46 PM
[quoted text, click to view]


Why would changing the stream type fix the issue? It seems to have to
do with how the decrypt function is written or maybe with how the
encrypt function writes the string.

jdn
jiany NO[at]SPAM online.microsoft.com
9/8/2003 6:21:40 AM
Hi Jdn,

I replied the following post in the
microsoft.public.dotnet.framework.aspnet group. It is the same issue as
this thread. Please check it when you have time.

"TripleDES Encryption issue"

If I have misunderstood your concern, please feel free to let me know.

Best regards,

Jacob Yang
Microsoft Online Partner Support
<MCSD>
Get Secure! ¨C www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.
Drebin
9/8/2003 11:28:07 AM
There are several kinds of streams, IO streams, memory streams, XML =
streams.. etc.. so if you are dealing with a filestream - then you will =
only really be able to read/write from a file.. if you want to =
read/write to a variable, you likely need a MemoryStream or some =
equivalent..


[quoted text, click to view]


Why would changing the stream type fix the issue? It seems to have to=20
do with how the decrypt function is written or maybe with how the=20
encrypt function writes the string.

jdn
jdn
9/8/2003 12:18:15 PM
[quoted text, click to view]

No, I know that. Since I am trying to Encrypt and Decrypt using
MemoryStream and CryptoStream both places, I don't see how changing that
will solve the issue. Though maybe I'm missing something.
AddThis Social Bookmark Button