Databases
StackOverflow2013
Postsdbo
PO
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>At the very least, you are using differing initialization vectors (IV).</p> <ul> <li><p>The .Net code uses the key for IV.</p> <pre><code>private static AesCryptoServiceProvider GetProvider(byte[] key) { //Set up the encryption objects AesCryptoServiceProvider result = new AesCryptoServiceProvider(); byte[] RealKey = Encryptor.GetKey(key, result); result.Key = RealKey; result.IV = RealKey; return result; }</code></pre> <p>and </p> <pre><code>private static byte[] GetKey(byte[] suggestedKey, AesCryptoServiceProvider p) { byte[] kRaw = suggestedKey; List kList = new List(); for (int i = 0; i &lt; p.LegalKeySizes[0].MinSize; i += 8 ) { kList.Add(kRaw[i % kRaw.Length]); } byte[] k = kList.ToArray(); return k; }</code></pre> <p>which should probably be: <code>kList.Add(kRaw[(i / 8) % kRaw.Length]);</code>. Otherwise a key whose length % 8 == 0 will use the same letter repeatedly, doh!</p> <p>Thus the IV (and key) used by .Net is: <code>hleolhleolhleolh</code>. This is not part of the API, but rather due to the wrapper code that you pointed at (which has a serious bug in it...).</p></li> <li><p>The iPhone code uses 0 for IV.</p> <pre><code>// Initialization vector; dummy in this case 0's. uint8_t iv[kChosenCipherBlockSize]; memset((void *) iv, 0x0, (size_t) sizeof(iv));</code></pre></li> <li><p>openssl by default prepends a randomly generated salt (which is why the output is longer!).</p></li> </ul> <p>The openssl output is more secure since it is prepending a random initialization vector. It looks like the first few bytes of the base64 decoded string is "Salted__". You can also ask openssl to not use a salt (-nosalt) and / or provide an IV (-iv).</p> <p>Essentially, openssl, .Net, and the iPhone are using the same encryption, you just need to be careful how you initialize the APIs with the encryption key and the initialization vector.</p>
    singulars
    1. This table or related slice is empty.
    1. POAES interoperability between .Net and iPhone?
      singulars
      1. PTQuestion
    1. PTAnswer
    1. USjohnny
    1. USjohnny
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. POAES interoperability between .Net and iPhone?
      singulars
      1. PTQuestion
    1. This table or related slice is empty.
    1. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    1. COThanks! Once I changed the .Net to use the correct key and 0's for the IV, the output is the same. What should the IV be though? Is 0's OK? Would it be more secure if I used something else?
      singulars
      1. PO
      1. USDavid Veksler
    2. COIV=0 is only OK if you use each key only once. Otherwise you should use a changing IV (a counter, a nonce or a fully random IV). One of the risks with using a static IV is that the same clear-text will generate the same encrypted text each time, which opens up for many attacks.
      singulars
      1. PO
      1. USAnders Westrup
    3. CONormally you will use a secure hash algorithm to derive the key and the IV from the password and a random salt. For example, see RFC 2898, which I think uses HMACSHA1.
      singulars
      1. PO
      1. USCheeso
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload