Using AES encryption across javascript and c#

Question

I'm trying to encrypt a string in javascript and then decrypt it back in server using c#. I thought of using System.Security.Cryptography.Rijndael on server side and some AES implementation like this or this on client-side.

I don't know much about cryptography, so basically I generate a key and send it to client and encrypt my text with that key and send it back to server.

My problem is that Javascript AES implementations use a key to encrypt a text but c# Rijndael class uses a key and a vector. where does that vector come from?

You should look at stackoverflow.com/a/11859450/1310220, somebody else had a similar problem. The issue is normally the way the key and IV is set on each side and ensuring the encryption mode is correct. Almost everybody uses CBC (cipher block chaining), so the IV and key are normally most complex to get right. — jleahy
– jleahy, Commented Sep 14, 2012 at 14:53

Kerrek SB · Accepted Answer · 2012-09-14 12:42:41Z

2

AES is just a block cipher, which is a cryptographic primitive. Its purpose is to encrypt one single block of data (16 bytes).

Encryption requires a lot more than that. You need a method to encrypt an arbitrary amount of data, and hopefully in a way that doesn't give away any information. To do this, you need to break the amount of data into blocks, pad the last part to a full block, and then somehow encrypt each block in a clever way. Doing that is the responsibility of the encryption mode.

The most trivial mode (electronic cookbook, ECB), just encrypts each block with the same key, but that's horribly dangerous. Other modes require some sort of initialization state, which needs to be random but can be publicly known.

To encrypt and decrypt your data, you must know both the block cipher and the encryption mode, on both sides, and you must find a way to generate the initial state on the encrypting side and to recover it on the decrpyting side to initialize the encoder and the decoder, respectively.

In a nutshell: You need a lot more information about what you're doing!

answered Sep 14, 2012 at 12:42

Kerrek SB

480k96 gold badges904 silver badges1.1k bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

nima Over a year ago

Do you have a simpler solution for what I'm trying to do. I don't need top secret security, just don't want to send plain text on the network.

Kerrek SB Over a year ago

@nima: Just make sure you know all the details of the encryption used on both ends, and then set up both ends accordingly. As I said, you will need to know the encryption mode.

nima Over a year ago

I think your right, there's no easy way around this, so I started reading a book about it :) thanks

Simply G. Over a year ago

I hope you didn't give up, if you are still looking for an decently easy fix that doesn't require deeper studies in Cryptography I hope you let us know.

Simply G. Over a year ago

Also you might consider using C# both client and server-side to reduce complexity.

Simply G. · Accepted Answer · 2012-09-19 12:17:43Z

0

This isn't perhaps exactly what you are looking for. But I can think that what you actually need to do is implement SSL.

http://en.wikipedia.org/wiki/Secure_Sockets_Layer

This might solve your problem without needing to get involved with coding cryptography.

answered Sep 19, 2012 at 12:17

Simply G.

2352 silver badges9 bronze badges

Collectives™ on Stack Overflow

Using AES encryption across javascript and c#

2 Answers 2

5 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

5 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related