Question

I have a very strange situation.
Basically I have code that uses a decryptor created by:

Dim des3 As New TripleDESCryptoServiceProvider
des3.Mode = CipherMode.CBC
Return des3.CreateDecryptor(_encKey, _initVec)

The _encKey and _initVec are hardcoded.
I use it by calling:

Dim res() As Byte = decrypt(Convert.FromBase64String(_data))
m_transformDec.TransformFinalBlock(res, 0, res.Length)

Here _data is a string containing the encrypted value. m_transformDec is the Decryptor created previously.

Usually this works. Occasionally, I get a “bad data” error. I print out the value of _data, and it is always the same.

The code is multithreaded, which I suspect is the reason for both the problem, and it being hard to reproduce. The decryptor is created in the creation of the class, and the decryption is done in a Shared function, but I don’t see anything there which is not thread-safe.

Any ideas?

Answer 1

1. You should not assume anything is safe for concurrent calls unless you have reason to believe it is. In the docs, you have the boilerplate text that instance members are not guaranteed to be thread-safe, so you should defensively lock the des3 object when you’re using it.
2. You should not be hard coding the initialization vector; it should be randomly chosen when encrypting data, then stored in some way with the encrypted data (many people choose to tack it onto the beginning of the data, then remove it and use it for decryption; use whatever storage scheme you prefer, though). Using the same IV defeats the purpose of the IV, which serves to make plaintext attacks more difficult.