Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
HomeAnnouncementsFree MagazinesWhite PapersSubmit Content
Discussion GroupsASP.NETWindows FormsLanguages.NET FrameworkVisual Studio.NET
Articles.NET FrameworkASP.NETToolsWindows Forms
.NET DirectoryOpen Source ProjectsUser GroupsWeb Resources
Related Topics
Visual Basic 6SQL ServerMS AccessOther DB ProductsMS Server ProductsMore Topics ...

.NET Forum / .NET Framework / Security / September 2005

Tip: Looking for answers? Try searching our database.

Correctly using RSACryptoServiceProvider?

Thread view: 
Enable EMail Alerts  Start New Thread
Thread rating: 
Neelay - 22 Sep 2005 23:04 GMT
Hi guys,
 I am writing a simple client-server app and the client sends requests to
the server. The client and server communicate using sockets.

 I want to encrypt the client request using servers public key. This is
what I am currently doing...In the setup program, I created an object of
RSACryptoServiceProvider...That essentially creates a new public/private key
pair, right? So, I exported both the keys in xml and stored it on the local
filesystem. So, now the client has access to the servers public key xml file.

 Now, when the client wants to send the request this is what I am doing...

RSACryptoServiceProvider * pobjRSACrypto = new RSACryptoServiceProvider();
pobjRSACrypto->FromXmlString (strServerPublicKey);
//strServerPublicKey is the contents of the ServerPublicKey.xml
Byte byteEncrypted[] = pobjRSACrypto->Encrypt(byteData, false);   

 Now the server does the following

RSACryptoServiceProvider * pobjRSACrypto1 = new RSACryptoServiceProvider();
pobjRSACrypto1->FromXmlString(strServerKeyPair);
//strServerKeyPair has the contents of the ServerKeyPair.xml
Byte byteDecryptedText [] = pobjRSACrypto1->Decrypt(byteEncrypted, false);
String * strDecryptedText = pAscii->GetString(byteDecryptedText);

But, this is what i have observed: Even though I am encrypting the same
plain text, the resulting encrypted text is different every time....Is that
right? Also, the decryption using the private key works...I am just wondering
if I am using the APIs correctly....I mean I am not using a new key pair
every time, right?

Also, is FromXml() should acheive the same as ImportParameters() right?

In short my idea is, generate the key pair once, have it on the local
filesystem and then at run time use that to encrypt and decrypt...

Please let me know if I am doing somethin wrong OR if my understanding is
wrong somewhere?

Thanks,
 Neelay
Jas - 26 Sep 2005 20:19 GMT
This reply is not an attempt to answer the questions you asked, but i wanted
to make a comment -  You mentioned you would like to encrypt communications
between the client and server.  Because RSA can be used to do more than
provide confidentialy, you might be over-engineering the solution.  If you
would just like to protect yourself from an intermediate party being able to
read the transactions going over the wire you could just SSL.  This will also
not require you to store the servers public key on the client, and get rid of
the whole key management issue.
William Stacey [MVP] - 26 Sep 2005 22:45 GMT
Right.  And if using sockets, you can use 2.0s SslStream authenticated
stream class.

Signature

William Stacey [MVP]

> This reply is not an attempt to answer the questions you asked, but i
> wanted
[quoted text clipped - 9 lines]
> of
> the whole key management issue.

Free Magazines

Get these publications absolutely FREE for up to 12 months. There are no hidden fees and no obligation. Simply choose a title, complete the application form and submit it. Read more ...

Oracle MagazineNetwork ComputingComputer WorldBio-IT WorldeWeekInformation WeekInfosecurity
 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2009 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.