Encrypting Data

[Brian P. Hammer]

All - I have an app that saves data to a xml file via a dataset. Our company stores some data in various xml files that is now considered a risk under its security policy. What's the best way to encrypt and decrypt the data in the file.

I use a dataset to load data to my forms and commit changes to the dataset and then write it to the xml file.

Thanks,
Brian

[Fredrik Wahlgren]

"Brian P. Hammer" <bhammer@le "DASH" aviation.com> wrote in message news:%2***************@TK2MSFTNGP09.phx.gbl...
All - I have an app that saves data to a xml file via a dataset. Our company stores some data in various xml files that is now considered a risk under its security policy. What's the best way to encrypt and decrypt the data in the file.

I use a dataset to load data to my forms and commit changes to the dataset and then write it to the xml file.

Thanks,
Brian

That depends on how you use these files. You can encrypt the entire file or individual elements. I need to know more to give a descent advice.

/Fredrik

[Chris Rolon]

To control access to the files on disk, you could enable EFS on the file
system. That will keep prying eyes from being able to examine the files on
the drive.

To transmit the data using Web Services, look at WS_Security.
--

Chris Rolon
"Brian P. Hammer" <bhammer@le "DASH" aviation.com> wrote in message
news:#S*************@TK2MSFTNGP09.phx.gbl...
All - I have an app that saves data to a xml file via a dataset. Our
company stores some data in various xml files that is now considered a risk
under its security policy. What's the best way to encrypt and decrypt the
data in the file.

I use a dataset to load data to my forms and commit changes to the dataset
and then write it to the xml file.

Thanks,
Brian

[Brian P. Hammer]

We use the files to track market values of some aircraft. Each customer has a different file/xml data file. Internally, the files are stored on a secure file server with permissions. The real case is that sometimes, the files are emailed and found on client workstations. As you know, you can open the file with a text editor or browser.

The files can be saved from and opened with our application. It is not the element that is the problem, it's the data within the element. For example, some files contain how much they paid for the asset and which executives use it. This is the type of data I want to scramble so that it appears meaningless.

Thanks,
Brian

"Fredrik Wahlgren" <fr****************@mailbox.swipnet.se> wrote in message news:%2***************@tk2msftngp13.phx.gbl...

"Brian P. Hammer" <bhammer@le "DASH" aviation.com> wrote in message news:%2***************@TK2MSFTNGP09.phx.gbl...
All - I have an app that saves data to a xml file via a dataset. Our company stores some data in various xml files that is now considered a risk under its security policy. What's the best way to encrypt and decrypt the data in the file.

I use a dataset to load data to my forms and commit changes to the dataset and then write it to the xml file.

Thanks,
Brian

That depends on how you use these files. You can encrypt the entire file or individual elements. I need to know more to give a descent advice.

/Fredrik

[Brian P. Hammer]

Sorry, this won't work as the files can be copied form the server and
emailed. Thanks....

"Chris Rolon" <ch*********@removethis.neudesic.com> wrote in message
news:ev**************@TK2MSFTNGP14.phx.gbl...

To control access to the files on disk, you could enable EFS on the file
system. That will keep prying eyes from being able to examine the files on
the drive.

To transmit the data using Web Services, look at WS_Security.
--

Chris Rolon
"Brian P. Hammer" <bhammer@le "DASH" aviation.com> wrote in message
news:#S*************@TK2MSFTNGP09.phx.gbl...
All - I have an app that saves data to a xml file via a dataset. Our
company stores some data in various xml files that is now considered a
risk
under its security policy. What's the best way to encrypt and decrypt the
data in the file.

I use a dataset to load data to my forms and commit changes to the dataset
and then write it to the xml file.

Thanks,
Brian

[Fabio Cozzolino [MCAD]]

Hi Brian,
you can encrypt the important information by using classes in
System.Security.Cryptography namespace. If there are large data, you
can use symmetric algorithms, for example Rijndael, with unique secret
key for encrypt/decrypt. Note that is most important to protect key,
more than the type of used algorithm. I suggest you the use of
asymmetric algorithm for to protect symmetric algorithm's secret key.
you can start here:
http://msdn.microsoft.com/library/de...icServices.asp

HTH

[Brian P. Hammer]

Fabio - Thanks for the feedback. Looks like the msdn article will be
helpful.

Regards,
Brian

"Fabio Cozzolino [MCAD]" <co*************@gmail.com> wrote in message
news:11**********************@g14g2000cwa.googlegr oups.com...

Hi Brian,
you can encrypt the important information by using classes in
System.Security.Cryptography namespace. If there are large data, you
can use symmetric algorithms, for example Rijndael, with unique secret
key for encrypt/decrypt. Note that is most important to protect key,
more than the type of used algorithm. I suggest you the use of
asymmetric algorithm for to protect symmetric algorithm's secret key.
you can start here:
http://msdn.microsoft.com/library/de...icServices.asp

HTH

[Morten Dahl]

Fabio Cozzolino [MCAD] wrote:

Note that is most important to protect key,
more than the type of used algorithm. I suggest you the use of
asymmetric algorithm for to protect symmetric algorithm's secret key.

Just a note..

When you use encryption (at most in this situation) you're basically
exchanging a big secret (the data you want to protect) with a little
secret (the key). Therefore you still have a secret to store..

Encrypting your symmetric key with a asymmetric key still requires you
to store a secret, and it's not always the best option.
A symmetric key can be just a hash (see HashAlgorithm-class) of a
pass-word/-phrase - and while it's properly possible to make this work
with a asymmetric key as well, it's more complicated.

But the asymmetric approach is often used (in NTFS's EFS among others)
when you have more users that require access to the same file: on NTFS
the file (the data) is encrypted by a symmetric key, which in turn is
encrypted with each users asymmetric key.

And a finally: you shouldn't encrypt non-random data with a asymmetric
cipher, because in some algorithms this weakens the key (RSA included).

HTH

[Fredrik Wahlgren]

Morten, can you expand on this comment, please. I have never heard this
before. I'm completelt satisfied with a URL.

And a finally: you shouldn't encrypt non-random data with a asymmetric
cipher, because in some algorithms this weakens the key (RSA included).

/Fredrik

[Brian P. Hammer]

Morten - Guess I still need to do lots of reading.... The company said
"can't you just turn letters into number and numbers into letters?" This is
easy to do and easy to figure out. I have several websites marked for
reading. Homework for this evening.

Thanks,
Brian

"Morten Dahl" <da**@cs.aau.dk> wrote in message
news:42***********************@news.sunsite.dk...

Fabio Cozzolino [MCAD] wrote:

Note that is most important to protect key,
more than the type of used algorithm. I suggest you the use of
asymmetric algorithm for to protect symmetric algorithm's secret key.

Just a note..

When you use encryption (at most in this situation) you're basically
exchanging a big secret (the data you want to protect) with a little
secret (the key). Therefore you still have a secret to store..

Encrypting your symmetric key with a asymmetric key still requires you to
store a secret, and it's not always the best option.
A symmetric key can be just a hash (see HashAlgorithm-class) of a
pass-word/-phrase - and while it's properly possible to make this work
with a asymmetric key as well, it's more complicated.

But the asymmetric approach is often used (in NTFS's EFS among others)
when you have more users that require access to the same file: on NTFS the
file (the data) is encrypted by a symmetric key, which in turn is
encrypted with each users asymmetric key.

And a finally: you shouldn't encrypt non-random data with a asymmetric
cipher, because in some algorithms this weakens the key (RSA included).

HTH