moderate encryption for a small amount of data

Question

i am writing an application that will need to store less than about 1mb of data. this data will be read and edited by the user. this data will be very simple ascii data. the application is in vb.net on a windows-form. the data will be stored locally on the person's computer. i have several questions.

1. what kind of encryption method should i use to store the data? the user wants something that is not too powerful, but not too simple either.

2. how should i store the data? why not just write it to some file and encrypt it using some medium encryption method?

3. is application settings data encrypted? perhaps i can store it that way? is it suitable to store about 1mb in application setting data? how would i do this? which variable would i use?

Answer 1

You can just use any stream based writing technology, and wrap the stream in a CryptoStream. This works great for saving to a file of any form, but will work with any storage medium that is stream based.

Also - application settings are not encrypted (by default).

Answer 2

Why the "not too powerful" requirement? You're either encrypting the data, or you're not. If you're encrypting the data and you're not using a strong encryption algorithm, you might as well not be encrypting at all.

Answer 3

You are going to need to ask some more questions.

Questions to ask:
How secure does this need to be?
Does anyone else have access to the binaries and the data?
Who are you protecting this from?

Encryption is hard and expensive. Implementing security will most likely impose some level of pain on the end user.

You need to think about the master key: how secure is it? where is it stored? how is it backed up? does it need to be backed up?
Some of this comes back to the value of the data and whether the user cares about getting the data back if the machine dies.

You could look at TEA.
You could generate a random AES key (however long you want) and store this as not-extractable in the machine key store and use the built in CryptoStream as suggested by @Reed Copsey.

I think that it is very important to work out what sorts of attacks you need to be resistant against and how much the customer values protecting the data.