473,406 Members | 2,467 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 473,406 software developers and data experts.

Encryption: Where to store Key/IV?

I've just written a small class to handle AES encryption for a web-based
application. I need to store the key and IV somewhere so that I can use it
consistently across my application. My thoughts on this are:

1) Store it in the database - Pointless. If the database is compromised, the
hackers have the encrypted data AND the key/iv.

2) Store it in web.config - Something about storing it in clear text just
doesn't sit well with me. :)

3) Store it as a constant in the AES class itself - Can be reverse
engineered.

4) Encrypt the key/iv and store in one of the above locations. Well, now I
need to protect the encryption for THAT. Back to Step #1. :)

So what's the best practice here?

Sep 28 '08 #1
0 2129

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

8
by: Joshua Beall | last post by:
Hi All, Up until now I have been storing passwords in the database as an sha1 hash. I like doing it this way, but a problem arises with people who forget their passwords - I cannot retrieve it...
3
by: Phil Palmieri | last post by:
Im using md5 to encrypt and decrypt plain text, this works fine... When i try to run the same function on a binary file, it does not decrypt correctly. Is there a way to encrypt binary files...
2
by: gaurav khanna | last post by:
Hi I need to store the credit card information in my database. I have been looking for some third party tools which could provide encryption for credit card numbers. The help I need is: a)...
5
by: Harman Sahni | last post by:
We have a public and private key pair for Credit Card data encryption. The database part is all done where we generated the key pair. Public key resides in the database for encryption and we...
113
by: Bonj | last post by:
I was in need of an encryption algorithm to the following requirements: 1) Must be capable of encrypting strings to a byte array, and decyrpting back again to the same string 2) Must have the same...
1
by: Diablo | last post by:
Hi, I want to encrypt some short text. I've chosen Rijndael algorithm (AES) for the encryption. The encryption process rounds the lenght of the input string to a multiple of 16. Then I have to...
7
by: B Maxey | last post by:
I have been working with encryption. And it seems to me that the IV and Key are the only things you need to decrypt my data. I can obfuscate, but my program still needs to 'call' the framework...
7
by: Mark Rae | last post by:
Hi, Picking your collective brains again, this time regarding the storage of the key used in symmetric encryption. Let's say you have a requirement to add encryption to a C# project, so you...
3
by: dmalhotr2001 | last post by:
I was wondering whether anyone ever dealt with encryption that are visa compliant with credit card numbers: On 3.4 of this document...
0
by: emmanuelkatto | last post by:
Hi All, I am Emmanuel katto from Uganda. I want to ask what challenges you've faced while migrating a website to cloud. Please let me know. Thanks! Emmanuel
1
by: nemocccc | last post by:
hello, everyone, I want to develop a software for my android phone for daily needs, any suggestions?
1
by: Sonnysonu | last post by:
This is the data of csv file 1 2 3 1 2 3 1 2 3 1 2 3 2 3 2 3 3 the lengths should be different i have to store the data by column-wise with in the specific length. suppose the i have to...
0
by: Hystou | last post by:
There are some requirements for setting up RAID: 1. The motherboard and BIOS support RAID configuration. 2. The motherboard has 2 or more available SATA protocol SSD/HDD slots (including MSATA, M.2...
0
by: Hystou | last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can...
0
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers,...
0
by: Hystou | last post by:
Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows...
0
tracyyun
by: tracyyun | last post by:
Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each...
0
isladogs
by: isladogs | last post by:
The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome a new...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.