Where to store symmetric hash key and vector?

Adam

Hi

I have a winforms application that will be installed on a clients machine. The client is able to create user logins for a website from this application.

I am using a hashing algorithm with salt values to produce different cipher text from the same plain text values encrypted with the same symmetric (Rijndael) key and initialization vector.

My problem is, where do I store the key and initialization vector? I know it's not recommended to hardcode them into the code due to a number of reasons including hackers being able to see the values, but how else do I store them?

Thanks

3 Replies

Know the answer? Post it — somebody with the same question will find it here.

Vulpes14y ago
Yes, keeping your keys secure is a big problem for any cryptographic system and there's no ideal solution.

Some developers prefer, as you say, to use web services to keep the problem off the client machine altogether. However, you then have a problem if the web service can't be accessed for some reason (for example the server is down) so it's still not ideal.
0
Adam14y ago
Thanks Vulpes, I'll take a look at the links now.

Is this quite a common problem or do people just move this kind of functionality to a webservice? (Which unfortunately isn't an option in this case).
0
Vulpes14y ago
Well, you'll need to store them in a file though you still have the problem that if hackers discover the path to the file they can see the values.

There are a couple of things you can do to make this more difficult.

One possibility would be isolated storage which is the mechanism used by Silverlight:

http://msdn.microsoft.com/en-us/library/system.io.isolatedstorage.isolatedstoragefile.aspx

Another possibility would be windows data protection on which I wrote an article a while back:

http://www.c-sharpcorner.com/uploadfile/b942f9/using-windows-data-protection/
0