Published: Wednesday, September 05, 2001
Using Symmetric Cryptography in an ASP.NET Web Page
By Mart Slim
| To Learn More... |
|---|
|
This article examines how to implement a specific type of security (symmetric encryption) through an
ASP.NET Web page. To learn more about ASP.NET, be sure to visit the ASP.NET
Article Index; for more information on encryption and security, be sure to visit the
Security Article Index.
|
Introduction
With classic ASP, implementing encryption algorithms either required a third-party COM component, or some
fairly heady scripts. (There are a number of articles on 4Guys that deal with encryption, see:
Encryption with ASP and Encrypting
the Information Passed through the QueryString for starters.)
Encryption via an ASP.NET Web page is, in my opinion, much simpler and easier than in classic ASP. With
the .NET Framework, all of the cryptographic classes are held in the System.Security.Cryptography
namespace, making it easy to add cryptographic functionalities into your applications. In this article we'll
examine how to encrypt data through an ASP.NET Web page, but before getting
into gory implementation details, let's skim through some basics of cryptography:
There are generally two main types of encryption and decryption algorithms, symmetric and asymmetric. In
symmetric encryption, a secret key or password is used to scramble data. In order to decrypt the scrambled
data, the same key has to be used. DES and
RC2 are examples of symmetric algorithms.
On the other hand, asymmetric algorithms use a related key-pair to encrypt and decrypt data. One of the keys
in the pair is typically called a public key while the other is called a private key. Data encrypted with a
public key can only be decrypted with the private key, and vice-versa. PKI (public key infrastructure) is
built based on asymmetric algorithm. RSA is a popular asymmetric algorithm.
Another key component of cryptography is hash functions. These functions map input data of any length to
a fixed length output. Unlike encryption/decryption algorithm, hash functions are generally one way (i.e.
their scrambled data is not reversible) and are designed to guarantee fixed length and unique result set
as long as the input string is unique. Usage of these functions are varied but they are commonly used to
generate digital signatures in public key cryptography.
The Code
This article demonstrates how to perform symmetric encryption using C# through an ASP.NET Web page.
Specifically, we will be creating a class (in C#), compiling it into a DLL, and then using the DLL through
an ASP.NET Web page. (Sample code is also included in the download showing how to use the DLL through a
Web service!)
In this code,
the DES algorithm with a 64-bit key is used. While the sample code is specific to DES, it can be easily
modified to use other symmetric cryptography algorithms like TripleDES or RC2. The main intent here is not
to be exhaustive, rather, it is to demonstrate the technique of using .Net's cryptography namespace to
perform symmetric encryption.
A class called FE_Symmetric that exposes two functions has been written:
public string EncryptData(String strKey, String strData)
This function takes in a Secret Key, strKey and the input data, strData. The return
string is base64 encoded so that it can be transported over the HTTP GET/POST. If encryption fails, an empty
string returns.
public string DecryptData(String strKey, String strData)
This decryption function takes in the secret key used to encrypt the input data, strData.
strData must be base64 encoded. The function returns an empty string to indicate error.
There are three main points about the sample code that is worth noting, otherwise, the comments in the
code are self explanatory.
- In the .NET Framework, the cryptography service adopts a stream-oriented design. In the case of the
sample code, the
CryptoStream class and its derivative class MemoryStream is used.
- SHA1 was used to hash the secret key. SHA1 returns a 160-bit hash and the first 64-bit of the hash is
used as the key for DES encryption.
- The return result of the encrypt functions is base64 encoded so that the result can be transported over
HTTP and displayed in HTML forms by default.
Included in the Sample Files
At the end of this article you'll find a link to download the complete sample files. In these files you'll
find the source code for the encryption/decryption class; this class should to be compiled into a DLL,
although a DLL is already provided in the download
(a makefile is also included in the download, in case you decide to compile the source code yourself). This
DLL must then be moved into the /bin directory, at which point you will be able to use it
through an ASP.NET Web page or Web service.
A complete listing of files in the download can be seen below:
Symmetric.cs - The C# source of the code
Symmetric.asmx - The functions of the class FE_Symmetric exposed as a web service
Client.aspx - This is the HTML form that demonstrates how to use the managed Symmetric.Dll
Makecs.bat - Makefile to compile Symmetric.cs into Symmetric.Dll
Symmetric.Dll - The DLL to be placed in the BIN folder of your application
For information on using the .NET Framework for asymmetric encryption, be sure to check out
these
technical docs. Also, be sure to
view the live demo.
Happy Programming!
By Mart Slim
Attachments:
Download the complete source code (in ZIP format)
Visit the Security Article Index
Visit the ASP.NET Article Index
View a live demo!
