Home/ Questions/Q 865543
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-15T09:39:20+00:00

My application makes use of the RijndaelManaged class to encrypt data. As a part

  • 0

My application makes use of the RijndaelManaged class to encrypt data. As a part of this encryption, I use a SecureString object loaded with a password which get’s get converted to a byte array and loaded into the RajindaelManaged object’s Key at runtime.

The question I have is the storage of this SecureString. A user entered password can be entered at run-time, and that can be “securely” loaded into a SecureString object, but if no user entered password is given, then I need to default to something.

So ultimately the quesiton comes down to:

If I have to have some known string or byte array to load into a SecureString object each time my application runs, how do I do that? The “encrypted” data ultimately gets decrypted by another application, so even if no user entered password is specified, I still need the data to be encrypted while it goes from one app to another. This means I can’t have the default password be random, because the other app wouldn’t be able to properly decrypt it.

One possible solution I’m thinking is to create a dll which only spits out a single passphrase, then I use that passphrase and run it through a couple of different hashing/reorganizing functions at runtime before I ultimately feed it into the secureString object. Would this be secure enough?

Edit For clarity*: The encrypted data is being passed via files between machines. Think of it as a Zip file which always has a password, a default one is assumed if nothing is directly entered by the user.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    There is no point in symmetrically encrypting with a string that’s hard-coded into your executable. It will only give a false sense of security. No amount of hashing fixes this scheme.

    See this Pidgin FAQ for the same point in a different context.

    I am unclear why you think you need the inter-app communication to be encrypted. If this communication is local to the machine, then I don’t see the need for encryption, particularly encryption that isn’t user-specific. Is this a DRM scheme?

    EDIT: If it’s being passed to a different machine, perhaps you can hard-code a public key, and then have the other machine decrypt with the matching private key.

    • 0