You can write a simple wrapper around GNU PGP which basically executes the GPG command from Java. The advantage of using GNU PGP is that you will not be tied to a specific library. The amount of documentation and support available online for third-party libraries is not as rich as other encryption schemes since most … Read more
The best way is to do the crypto on the client or application server, so the database has no idea what the keys are and cannot decrypt the data. If the client / appserver are on a different host, all the better. If your database is encrypting and decrypting the data for you, then it’s … Read more
The threat model is very important in this case as encrypting a database efficiently is not an easy task, this can be done at 3 different layers (client-application, storage-device, data-base-itself) note that in all cases if the client application is compromised the encryption is useless, self data base encryption solution cover the least threat models … Read more
I know this post is old, but it took me forever to figure this out, so I thought I would share. To test I created RSA keys using OpenSSL: openssl genrsa -out privateKey.pem 512 openssl rsa -in privateKey.pem -pubout -out publicKey.pem You will need the following 2 nuget packages: https://github.com/dvsekhvalnov/jose-jwt http://www.bouncycastle.org/csharp/ Test Code public static … Read more
You should avoid using RSACryptoServiceProvider if you can. It only works on Windows (and it’s the less good RSA implementation on Windows). Stick to the RSA base class, and create new instances via RSA.Create() Ephemeral Keys (Creation) .NET Core using (RSA rsa = RSA.Create()) { rsa.KeySize = desiredKeySizeInBits; // when the key next gets used … Read more
You really ought to do this the correct way 🙂 1) Use a securely generated random IV 2) Use a securely generated random key 3) Don’t use ECB mode – EVER AesManaged aes = new AesManaged(); aes.GenerateKey(); aes.GenerateIV(); The code above will correctly and securely generate a random IV and random key for you.
My answer is based on reading the Maven source code and doing a little research. Does the encrypted master password provide security simply by existing in settings-security.xml in a folder that only one user can access (~/.m2)? If so, why bother with encrypting a ‘master password’ (why not just use some random value)? Isn’t the … Read more
For output as Hex-String import java.security.*; public class Test { public static void main(String[] args) throws NoSuchAlgorithmException, NoSuchProviderException { KeyPairGenerator keyGen = KeyPairGenerator.getInstance(“RSA”); keyGen.initialize(512); byte[] publicKey = keyGen.genKeyPair().getPublic().getEncoded(); StringBuffer retString = new StringBuffer(); for (int i = 0; i < publicKey.length; ++i) { retString.append(Integer.toHexString(0x0100 + (publicKey[i] & 0x00FF)).substring(1)); } System.out.println(retString); } } For output as … Read more
Question 1: Reply YES as you use HTTPS encryption for connections Question 2: For what you said about your app the reply is NO. In brief you don’t use any function inside your app that use a custom cryptography or it’s strictly medical app. The encryption that you use it’s only for data passing from … Read more
Store the password+salt as a hash and the salt. Take a look at how Django does it: basic docs and source. In the db they store <type of hash>$<salt>$<hash> in a single char field. You can also store the three parts in separate fields. The function to set the password: def set_password(self, raw_password): import random … Read more