Contents
Is it safe to send encryption key without encrypting it?
Sending the key across an insecure network without encrypting it is unsafe, because anyone who intercepts the key and IV can then decrypt your data. The following example shows the creation of a new instance of the default implementation class for the Aes algorithm.
Can a person decrypt with a private key?
If you’re encrypting with a private key and decrypting with a public key, that’s not safe from prying eyes. All it says: “this data is coming from person X who holds private key X” and anyone can verify that, because the other half of the key is public. What’s to stop someone you don’t trust putting public key X on a server you don’t trust?
Do you need a key for symmetric encryption?
The symmetric encryption classes supplied by the .NET Framework require a key and a new initialization vector (IV) to encrypt and decrypt data. Whenever you create a new instance of one of the managed symmetric cryptographic classes using the parameterless constructor, a new key and IV are automatically created.
Is it safe to use an API key and secret?
Ok, any good API will use some transport security like TLS (usually over HTTPS). But you’re still exposing your private key to the server that way, increasing the risk of them somehow mishandling it (see: GitHub and Twitter’s password logging bug recently discovered).
How can one secure a password / key in source code?
With obfuscation, this is pretty tough to crack especially if the correct order of the objects is hard to determine (eg. it changes depending on the application environment). Note that standard practice for storing passwords ANYWHERE is to never store the password itself.
Is the secret key used in encrypting messages?
These techniques typically feature a secret “key” or piece of information that is used when encrypting the message. While the algorithm can be publicly known, the secret key is not.