What are the best practices for encrypting data in .NET?

Question

What are the best practices for dealing with

1. Things that should be hashed. i.e. passwords

and

1. Things that cannot be hashed, but are extremely confidential and would cause tremendous pain if compromised. i.e. credit cards, SSN, missle launch codes.

Which encryption algorithm is strongest, most recommended? How you do handle the keys?

Answer 1

There are built in crypto libraries you can use in .Net. There are many good symmetric and asymmetric encryption algorithms (AES, RSA, etc) Many of these algorithms let you select how strong a key you want (1024bit, 2048bit, etc).

Storing your keys is a much dicier situation. I suggest not in a plain text file. There are algorithms out there for slpitting encryption keys in half so that responsibility is divided.

Answer 2

Regarding hashing, there are built in libraries for performing hash operations (much like the crypto libraries) that make it fairly straightforward to hash a value for storage.

In addition to looking into these libraries, you should also consider adding "salt" to the hashes, which essentially means adding some extra data to the value being hashed prior to the hashing and adds an extra layer of security. In this way even if an attacker knew which hashing algorithm you used they wouldn't easily know how you salted the data before hashing it.

Another thing to consider would be using the System.Security.SecureString for moving these protected values unencrypted/unhashed around in memory. Using a standard string means that the data being contained in the string is on the heap in plain-text and may actually remain there for a time even after the string goes out of scope. If someone could get a dump of the memory from the machine he/she might able to extract that unprotected data. In some scenarios this might be overkill, but something to look at.