Encryption Algorithm for Web Applications

Question

I have been using Symmetric (Rijndael) Key Algorithm (http://www.obviex.com/samples/Encryption.aspx) for a while to encrypt an ID. Then I URL encode the encrypted version of the ID and pass it in the query string. When I retrieve the ID from the query string, I URL decode it first and I decrypt it.

A problem came up recently. If the encrypted ID has both "spaces" and "+" (eg "abc ef+g), URL-encoding it changes all "spaces" to "+". This is a problem when I URL-decode the ID since I don't know which "+" was a "+" and which "+" was a "space".

If there an option that I can pick the output character set to be only the alphabet (ie the encrypted ID only uses A-Z)? Or if there any other 2 way encryption algorithm that has th option for me to pick the output character set?

Or I guess my last option would be to manually replace "+" in the encrypted ID with something like "_SPACE_"

Thanks

Answer 1

Well, to answer your question at a basic level: Yes, encode the encrypted result in base64.

But I must admit, I'm pretty concerned about your approach in general.

Answer 2

you should take a look at how I decided to manage my way of hiding id (in my case guid, but can be any encrypted string)

link

Answer 3

You need to URL encode your encrypted ID when passed as query parameters.

I prefer an URL-safe version of Base64 for anything used in query parameters or cookies.

Answer 4

Can you manually encode the URL so the spaces are changed to %20 instead of +?