Question

I am sending Data from a Server to a Client over the Internet using WCF web services in form of Data Objects. I have created a Class, which is Serializable, and using this class to send my data.

Below is an example of my class:

[Serializable]
public class DBOList
{
    public string A{ get; set; }
    public string B { get; set; }
}

Is it possible for me to Encrypt the data in this object, and send it to the client as a stream?

If not What is the best approach to achive this?

Encryption Code:

        DBOList NewLst = new DBOList();
        NewLst.A = "Value 1";
        NewLst.B = "Value 2";

        byte[] key = { 1, 2, 3, 4, 5, 6, 7, 8 };
        byte[] iv = { 1, 2, 3, 4, 5, 6, 7, 8 };

        DESCryptoServiceProvider des = new DESCryptoServiceProvider();

        // Encryption
        using (var fs = new MemoryStream())
        {
            var cryptoStream = new CryptoStream(fs, des.CreateEncryptor(key, iv), CryptoStreamMode.Write);
            BinaryFormatter formatter = new BinaryFormatter();

            // This is where you serialize the class
            formatter.Serialize(cryptoStream, NewLst);
            cryptoStream.FlushFinalBlock();
        }

Answer 1

It is best to use SSL instead, which will add all the security you need, while avoiding most pitfalls.

Short of that, you can of course use a CryptoStream. You can only encrypt bytes, but you already indicated that you understand this by mentioning Serializable.

Note that if you want to create your own secure stream you will need:

• two securely generated keys, and encryption and a MAC key
• a secure cipher such as AesManaged
• set using (the defaults) CBC and PKCS7Padding
• retrieve the randomly generated IV and prepend it to the ciphertext
• create a HMACSHA256 over the result

to be reasonably safe. If this does not ring any bells, use the most up to date TLS implementation.