Hello vla10d@gmail.com,

there are cryptanalysis methods, which take a different approach than brute
forcing.

By looking at data (and the bigger data the better) you can get the key,
this is especially true if you reuse the key (=password) for different encrypted
data and if the key (=password) is weak.

get the schneier book :)

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

Cool.  Basically all he is doing there is prepending X random salt bytes to
the data and stripping it off after the decrypt.  That was a lot of code to
show a simple idea.  The same thing could be done just "using" Rijndael
instead of deriving another class from it:

       /// <summary>
       /// Encrypt data bytes using AES encryption.  Decrypt using Decrypt
and supply the same password and options.
       /// Set useRandomSalt to true to add random salt the beginning of
the data before encryption.  The Decrypt method will remove the same
       /// amount of bytes before returning the data.  If saltSize is set
to 0 and useRandomSalt is true, the actual saltSized used will be
       /// selected at random.  If saltSize is greater then 0, saltSize
number of random bytes will be prepended to the data.
       /// Call Decrypt to decrypt the results of this method.  You must
use the same password, paddingMode, useRandomSalt and saltSize that was
       /// used in the call to this method.
       /// </summary>
       /// <param name="data">Clear data to encrypt.</param>
       /// <param name="password">Password used to derive a key to encrypt
the data.</param>
       /// <param name="paddingMode">Encryption padding mode.</param>
       /// <param name="useRandomSalt">Set to true to add random salt to
the beginning of data.</param>
       /// <param name="saltSize">Number of salt bytes to include in data.
Use 0 to select a random number of bytes between 5 and 30.</param>
       /// <returns>The encrypted data.</returns>
       public static byte[] EncryptData(byte[] data, string password,
PaddingMode paddingMode, bool useRandomSalt, int saltSize)
       {
           if ( data == null || data.Length == 0 )
               throw new ArgumentNullException("data");
           if ( password == null )
               throw new ArgumentNullException("password");

           byte[] keySalt =
SHA1.Create().ComputeHash(Encoding.UTF8.GetBytes(password +
password.Length));
           Rfc2898DeriveBytes pdb = new Rfc2898DeriveBytes(password,
keySalt);

           RijndaelManaged rm = new RijndaelManaged();
           rm.Padding = paddingMode;
           ICryptoTransform encryptor =
rm.CreateEncryptor(pdb.GetBytes(16), pdb.GetBytes(16));

           if ( useRandomSalt )
           {
               if ( saltSize < 0 )
                   throw new ArgumentOutOfRangeException("saltSize must be

               bool dynamicSize = false;
               if ( saltSize == 0 )
               {
                   dynamicSize = true;
                   saltSize = Utils.GenerateRandomNumber(5, 30);
               }

               RNGCryptoServiceProvider rng = new
RNGCryptoServiceProvider();
               byte[] dynamicSalt = new byte[saltSize];
               rng.GetNonZeroBytes(dynamicSalt);

               if ( dynamicSize )
               {
                   data = Utils.JoinArrays(new byte[] {
(byte)dynamicSalt.Length }, dynamicSalt, data);
               }
               else
               {
                   data = Utils.JoinArrays(dynamicSalt, data);
               }
           }

           using ( MemoryStream msEncrypt = new MemoryStream() )
           using ( CryptoStream encStream = new CryptoStream(msEncrypt,
encryptor, CryptoStreamMode.Write) )
           {
               encStream.Write(data, 0, data.Length);
               encStream.FlushFinalBlock();
               return msEncrypt.ToArray();
           }
       }

       /// <summary>
       /// Decrypt data bytes using AES encryption.  This decrypts a byte[]
that was encrypted with the Encrypt method.
       /// If useRandomSalt is true, this method will remove the required
amount of salt bytes before returning the decrypted byte[].
       /// If saltSize is set to 0 and useRandomSalt is true, the actual
saltSized used will be
       /// determined from the data. If saltSize is greater then 0,
saltSize number of random bytes will be removed from the data after
decryption.
       ///
       /// This method is intended to be used in pair with EncryptData.
Call DecryptData with the same password, paddingMode, useRandomSalt and
saltSize
       /// that was used in the EncryptData method.
       /// </summary>
       /// <param name="data">Encrypted data to decrypt.</param>
       /// <param name="password">Password used to encrypt data.</param>
       /// <param name="paddingMode">Padding mode used to encrypt
data.</param>
       /// <param name="useRandomSalt">Use same value passed to
EncryptData.</param>
       /// <param name="saltSize">Use same value passed to
EncryptData.</param>
       /// <returns></returns>
       public static byte[] DecryptData(byte[] data, string password,
PaddingMode paddingMode, bool useRandomSalt, int saltSize)
       {
           if ( data == null || data.Length == 0 )
               throw new ArgumentNullException("data");
           if ( password == null )
               throw new ArgumentNullException("password");

           byte[] keySalt =
SHA1.Create().ComputeHash(Encoding.UTF8.GetBytes(password +
password.Length));
           Rfc2898DeriveBytes pdb = new Rfc2898DeriveBytes(password,
keySalt);

           RijndaelManaged rm = new RijndaelManaged();
           rm.Padding = paddingMode;
           ICryptoTransform decryptor =
rm.CreateDecryptor(pdb.GetBytes(16), pdb.GetBytes(16));

           using ( MemoryStream ms = new MemoryStream(data) )
           using ( CryptoStream cs = new CryptoStream(ms, decryptor,
CryptoStreamMode.Read) )
           {
               // Decrypted bytes will always be less then encrypted bytes,
so len of encrypted data will be big enouph for buffer.
               byte[] dec = new byte[data.Length];
               byte[] clearBuf;

               // Read as many bytes as possible.
               int read = cs.Read(dec, 0, dec.Length);
               if ( read < dec.Length )
               {
                   // Return a byte array of proper size.
                   clearBuf = new byte[read];
                   Buffer.BlockCopy(dec, 0, clearBuf, 0, read);
               }
               else
                   clearBuf = dec;

               if ( useRandomSalt )
               {
                   if ( saltSize < 0 )
                       throw new ArgumentOutOfRangeException("saltSize must
be >= 0.");
                   if ( saltSize == 0 )
                   {
                       saltSize = clearBuf[0];
                       saltSize = saltSize + 1;
                   }
                   return Utils.TrimStartBytes(clearBuf, saltSize);
               }
               else
               {
                   return clearBuf;
               }
           }
       }

This does add salt and could save a trip to the DB just to lookup salt.
However, I am unclear how must actual protection (if any) it adds to the
encrypted data.  If you have the source or know what is doing, this still
does not protect against brute force, but would only make it a bit more
work.  The strength still remains in the key.  Valery can probably comment
on this more.