ASP.NET Security Tutorials

The .NET Asymmetric Encryption Algorithms

Asymmetric algorithms are based on mathematical methods that require different keys for encryption and decryption. Usually the key used for encryption is called a public key and you can give it to anyone who wants to send encrypted information to you. The private key is the only key that can be used for decryption. In this case you …

Learn more

The .NET Symmetric Encryption Algorithms

Symmetric algorithms always use the same key for encryption and decryption and they are fast for encryption and ecryption.

The next table lists symmetric algorithms supported by .NET:

 

Abstract Algorithm

Default Implementation

Valid Key Size

Maximum Key Size

DES
DES
DESCryptoServiceProvider
64
64

TripleDES
TripleDES
TripleDESCryptoServiceProvider
128,192
192

RC2
RC2
RC2CryptoServiceProvider
40-128
128

Rijndael
Rijndael
RijndaelManaged
128,192,256
256

 

The strength of the encryption corresponds …

Learn more

The .NET Cryptography Classes

The .NET encryption classes are divided into three layers.

1. The first layer is a set of abstract base classes and these classes represent an encryption task. The next table lists these classes:

 

Class …

Learn more

How to generate cryptographically strong random numbers in VB.NET

You can create strong random number values with the System.Security.Cryptography.RandomNumberGenerator class. You use these random key or salt values when you want to store salted password hashes. A salted password hash is a hash created from a password and a so-called salt where salt is a random value. This guarantees that even if two users select …

Learn more

How to generate cryptographically strong random numbers in C#

You can create strong random number values with the System.Security.Cryptography.RandomNumberGenerator class. You use these random key or salt values when you want to store salted password hashes. A salted password hash is a hash created from a password and a so-called salt where salt is a random value. This guarantees that even if two users select …

Learn more

How do Windows certificate stores work

Windows supports several types of certificate stores that are called store locations. You can create a separate store for each Windows service of a machine, and every user has a separate certificate store. Certificates are kept securely in those stores. The local machine store is encrypted with a key managed by the local security authority of …

Learn more

How to read X509 certificates in VB.NET

X509 certificates play an important role in the world of the Web, because they establish SSL communication and perform certificate authentication to secure traffic between the web server and its clients. Our site provides more details in the articles How does Secure Sockets Layer (SSL) technology work, How do certificates work and How does …

Learn more

How to read X509 certificates in C#

X509 certificates play an important role in the world of the Web, because they establish SSL communication and perform certificate authentication to secure traffic between the web server and its clients. Our site provides more details in the articles How does Secure Sockets Layer (SSL) technology work,  How do certificates work and  How does SSL work …

Learn more

The .NET Cryptography Namespace

You can find the necessary classes for encrypting and decrypting information in your application in the System.Secuirty. Cryptography namespace. In this namespace you can find also all the fundamental classes for creating different types of hashes. If you reference the additional assembly System.Security.dll, you have access to even more advanced security functionality such as an API for modifying …

Learn more

How to use Authorization with ASP.NET Roles in IIS 7.x

The native URL authorization module shipping with IIS 7.x, does not understand ASP.NET-specific role information, because this information is only encapsulated into managed objects implementing managed interfaces.   On the other hand, running IIS 7.x in ASP.NET integrated mode provides a unified HTTP processing pipeline where managed and native modules are processed within the same HTTP module …

Learn more