Home/ Questions/Q 8722771
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-13T07:29:17+00:00

I’ve got a question regarding C#. I am currently working on a medical software

  • 0

I’ve got a question regarding C#.

I am currently working on a medical software product, and one of the important things is to make sure that the patient’s data is encrypted. I got two questions regarding this:

1.) How secure is the Microsoft .NET implementation of AES (Rijndael) from System.Security.Cryptography? Does it have any known security flaws, or am I fine just using the MS implementation? (note, I know the basic background of how these algorithms work, but I am not really that deep into it to get an idea of how it works).

2.) Since the data is stored on the same PC as the application, how hard is it to get information from a C# application? Assuming I have somewhere in the code

string encrypPassword = "ThisIsMyPassword";
string encryptedString = EncryptString(ClearString, encrypPassword);
// save encryptedString to harddrive

I know that an attacker could just go down to the assemble code, and at that point there is nothing at all I can do against this (the system has to be able to encrypt / decrypt the data), but is there like a shortcut for C# to get the encrypPassword, since it is managed, or does something like this still require you to go down to the assemble code?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    If you have a fixed password compiled into your app, then you don’t need to care about the security of AES and known security faults because your data is simply not secure. A sufficiently knowledgable person with access to the PC will be able to decrypt all the data.

    And locating a fixed password usually doesn’t require any programming knowledge. A good hex editor will do in most case. You don’t even need to know what programming language was used.

    If your data is used by a single user, then you can tie the password for the patient data to his or her Windows password (or account). Windows provides some specific functions for that. See http://msdn.microsoft.com/en-us/library/aa302402.aspx for how to access it from .NET.

    • 0