|
Posted by
Paschal
on
|
So many encryption schemes (DES, SHA, etc...).
Which one is the best ?
|
|
|
|
Posted by
Dave
on
|
The age old question.
Lots of text out there on so I won't either bore you or conclude that you haven't looked at some of the text...
In short Asymmetric encryption only has a place for encrypting keys or in digital signatures. The keys that are encrypted are those that have been used by a symmetric algorithm for bulk encryption.
An example:
I want to send someone a file. I encrypt it using a symmetric algorithm (since it's significantly faster) and as a result have a key and a block of encrypted data. I can't send the key in the clear, so it must be sent securely. I could meet up with the person and give them the key - but then why do I need to encrypt? In short I encrypt the key. To do this I use an asymmetric algorithm using the
recipients
public key to encrypt. Since the recipient is the only person with the corresponding private key, they are the only one who can decrypt the key.
As I say loads of text out there on this.
So then, to determine the best algorithm - presuming a Symmetric algorithm - one has some choices:
Des - the original with a 64 bit key - not a full 64 bit key so now really breakable.
Thriple Des - should be three times stronger than des but it's not. Widely used, but now replaced by Aes
Rijndael - or Aes - the new standard algorithm and with a good key length (up to 256 bit). If you want other people to decrypt the information then really this is the one for you.
There are others such as Blowfish & Twofish by Schneier or RC2 by Rivest (the R in RSA) which are generally shipped with most crypto toolkits, but unless you have a specific need / requirement then their use is questionable.
SHA1 as a final note is a message digest / hash algorithm - meaning that it is one way only - the data can't be recovered after it is hashed.
Books to read in order of pain / endurance of reader:
C# Data Security Handbook (wrox) - MacDonald & Johansson (Good for use in .NET)
Java Cryptography (O'Reilly) - Knudsen (not .NET but good none the less)
Applied Cryptography (Wiley) - Schneier (Good on theory and some implementation)
Handbook of Applied Cryptography (CRC) - Menzes et al. (Superb for both the Maths and the implementation)
|
|
|
|
Posted by
michu
on
|
Yeah, what Dave has written is a good summary of the subject.
I'd like to point you additionaly to excellent (and free) e-book ".NET In Samples" which contains a lot of informations about encryption, .NET security and other stuff. You can get it from http://skilldrive.com/DOTNETinSamples.pdf
|
|
|
|
Posted by
michu
on
|
I just noticed that the link is dead. The right link is http://skilldrive.com/DOTNETinSamples.zip
|
|
|
|
|