Home/ Questions/Q 781375
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-14T20:13:11+00:00

Overview: I’m trying to design an application that will encrypt files to safely send

  • 0

Overview:
I’m trying to design an application that will encrypt files to safely send through Snail Mail (LARGE sets of data). I’m planning on using AES/RijndaelManaged encryption from .Net to encrypt the files initially, using a randomly generated key using RNGCryptoServiceProvider. I’m then encrypting this random AES key with a RSA Public key. The receiver of the data is the only one with the RSA Private key to decrypt it.

My question: Is this the proper way to do something like this? If so, is it safe to send this RSA-Encrypted key with the data since it requires the private key to decrypt?

EDIT – According to the Answers, this is indeed the proper way to go.

EDIT – Thanks for the replies. Now what I really want to know:
When having the end user generate their Public/Private key pair, what is the best way to save the Private key? I do not want it to be only accessible from one machine, so I am trying to avoid using the user’s key store. But MSDN says it is not safe to save the key to a file, so how else can you accomplish this?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Use PGP unless there’s a good reason not to. PGP is an open and ubiquitous standard for hybrid crypto commonly used in email. There are many implementations of PGP. The only .NET one I know is the BouncyCastle crypto project’s C# library. PGP actually provides a superset of the functionality you describe; for instance, PGP can also digitally sign messages.

    Regarding private key storage. The typical solution is to symmetrically encipher the private key before writing it to disk. Only the true owner of the private key knows the cipher secret, and they don’t tell anyone. That way, even if an attacker gets the private key file, they still have to compromise the secret or brute force the symmetric cipher. All the PGP implementations I know of do this.

    Please don’t reimplement PGP if it does what you want. PGP is pretty widely supported. Furthermore, mere mortals like myself (and presumably yourself) hardly stand a chance of getting everything right.

    • 0