views:

24

answers:

1

I'm new to the .NET CryptoProvider space, and am a little concerned by what I have seen regarding the repeated creation of the same key by the RSACryptoProvider. I am using a container because I am storing the key off to file on the server, like so (I export the CspBlob subsequent to this creation and reimport it later)...

_cp = new CspParameters { KeyContainerName = ContainerName };

In this case the ContainerName has a hardcoded value that I reference the container by. What's bothering me is that when I create the RSACryptoProvider, and by exentsion the key pair, the generated key values are always the same!

RSACryptoServiceProvider rsa = new RSACryptoServiceProvider(RSAKeySize, _cp);

If I change the name of the container, the key changes. There must be SOME other source of randomness than the container name when you create an RSACryptoProvider, right? Otherwise that makes the name of the container a password, which is not my intention.

+1  A: 

It's the name of a container, not of a generator.

If you want different keys each time, just create a new CryptoServiceProvider w/o referencing a container( == stored key-pair).

Henk Holterman
Right. So if I know the name of the container, I can recreate the same keypair anywhere?!That's awful security. That makes the name of the container a password.
Bob
@Bob. Er... no. The container by that name is stored in the computer's profile Application Data directory. If you open that container by name on the same computer, it will show you the key(s) inside. If you try to open it on another computer, there's nothing to fetch. The computer automagically generated the key the first time you used the container, and is keeping it safe for you for next time you need it. As @Henk suggested, there are other ways to get a *new* key.
ewall
Good, got it. That's all I needed. The key's randomness is attached to my profile and the container name. That works for me. Thank you.
Bob