2

I am currently working on an ASP.NET MVC 4.5.2 application. The application stores no really valuable data but in my opinion security should never be underestimated, even harmless data can get harmful in the wrong hands. So I decided to encrypt all user related data like chat messages and personal user data. I am using ASP.NET Identity to add users to the application. The user password is automatically hashed by the Identity Framework. But I wanted to go one step further and encrypt these datasets additionally, so that the password hash, e-mail address, username ... is also encrypted in the database. Every text message send by one application user to another should also be encrypted so that only the authorized users can read the content even if the database gets stolen.

After reading lots of articles about how to encrypt these datasets I decided to use something like AES or maybe other encryption algorithms. Encrypt and store data in a database is no big deal. The whole thing gets not really exciting until it comes to store the encryption keys. I've read a huge amout of tutorials and posts on plattforms like StackOverflow which discuss how to properly encrypt sensitive data, but most of the articles are ending without providing solid solutions on how to store encryption keys.

After some research I found some interesting answers from StackOverflow users on this topic:

The Vault is an open source project focusing on storing secrets. I want to provide these links here for other fellows searching for this topic but unfortunately my reputation is not high enough to add all links so I decided to provide only the two most relevant.

Reffering to PaulGs Answer...

[...] My implementation was to have a Key Server application running on a windows box. This application required entry of two separate 'key server master keys' before it could be used. These keys would be known only to the key server administrators. These keys are xor'd together to generate the Master Key, which is stored only in protected memory whilst the application is running. Application can then automatically generate cryptographically strong Key Encrypting Keys, which are stored in encrypted form using the Master Key. [...]

... my question is:

Edit:

How "good" is PaulGs procedure on a security point of view and how can I create "protected memory" as csharp developer? I hope this question is more specific as my last set of questions.

Community
  • 1
  • 1
John Doe
  • 415
  • 1
  • 4
  • 15
  • 1
    You're asking more or less separate questions. Consider splitting your post into multiple posts in order to prevent closure as **too broad**. – Artjom B. May 22 '16 at 19:38
  • If you want a secure solution there is one one way for you to achieve it, hire a cryptographic security domain expert to perform the design and review the code. – zaph May 22 '16 at 19:43
  • @ArtjomB. could you please specify how to split the post in multiple posts? do you mean I should ask different questions? I am very new to StackOverflow and my english is not that good. – John Doe May 22 '16 at 19:44
  • @zaph thank you for your comment on my question. the problem in hiring a cryptographic security domain expert is that the budget on this project is not that big to afford such an expert. – John Doe May 22 '16 at 19:47
  • Ah, so the ugly head of cost vs security appears and once again cost wins. We don't need to stinky security, just the appearance of it, let's encrypt something. – zaph May 22 '16 at 19:48
  • @zaph yes it is an annoying topic, but the application I am working on is a project at my university so there is no money for hiring someone ... – John Doe May 22 '16 at 19:50
  • What about the users, don't they deserve security? They are trusting you. – zaph May 22 '16 at 19:51
  • @zaph I absolutely agree with your point of view. But I think asking those questions and tackling those problems would gain knowledge and I bet there are many many other developers out there with great ideas and no money but with security in mind – John Doe May 22 '16 at 19:55
  • Creating a secure environment is not easy, is not something that one can learn in a short period of time, it is a multi-year process. Gaining enough information from SO or any Q&A site is just not possible, there are to many variables. One small error is all it takes to render all the security efforts unless. You need the questions a SME will ask, the threat model, the code review, etc. I have bene on your sides and the questions the SME asked were surprising, things I had not considered. The best bet is to put a large disclaimer in the app description that it is probably not secure. – zaph May 22 '16 at 20:05
  • @zaph yes I agree again with your answer, it is not even possible to create a secure application within days weeks or months, gaining enough knowledge to accomplish only the basic tasks is not easy, but finding high quality sources or quides on how to tackle these tasks is even harder. After days of research I almost surrendered and thought about hosting the application in the azure cloud so that I can use the Azure Key Vault, but it must be possible to achieve "basic" security and not just add a disclaimer which says "your data is encrypted but it's pointless". Any recommendations? – John Doe May 22 '16 at 20:12
  • Since you want to encrypt sensitive info sent by one user to another - don't you need end to end encryption of messages (https://en.wikipedia.org/wiki/End-to-end_encryption) instead of encrypting something on server? End to end basically means private keys are generated on user's devices and never transmitted. – Evk May 22 '16 at 20:40
  • Is this what you do with your health? Ask on Health Overflow how to set a broken bone, it's just a finger, how hard can that be? Why not, it is cheaper and most people do not have the budget for the medical care. Oh, maybe there is a small problem, you can then go to a doctor, have it re-broken and set properly. Azure is well vetted, why not use it. But do use good two-factor authentication and backup to some other place. – zaph May 22 '16 at 20:44
  • @Evk yes that is right, I want to encrypt user messages but to achieve end to end security I have to store the keys on the user device as you mentioned . But how to securely store these keys on the client side when the user has to access the application over the browser . So I thought about storing these keys on the server side and encrypt these keys with the master keys which are owned only by trusted system administrators. – John Doe May 22 '16 at 20:46
  • @zaph thank you for your clear words. I will get to my local bank and get a credit card to sign up for azure . Could you please explain what you mean with two factor authentication in this case ? The only other cloud provider with something like the azure key vault is Amazon aws so I should be able to deploy my application in cases where azure ends service or what do you mean ? – John Doe May 22 '16 at 20:54
  • 1
    @zaph don't you agree that some security is better than none at all? Say your database was stolen but sensitive data was encrypted, even in some dumb way with key freely available in server's memory (or even in file on disk), but the attacker didn't have time\competence to get to that key - that's already something. Same with health - if you have money you go to good doctor, if you don't have much you go to not so good doctor but that is still better than to leave yourself without any medical care at all. Or you propose "all or nothing" approach? – Evk May 22 '16 at 21:07
  • @Evk that's the point – John Doe May 22 '16 at 21:08
  • Yes, some security is better than none. In fact 100% security is virtually impossible. But you need to known what security you really have? You need to know the level of attacker you are protecting against. The value of what is being protected to you and the client. What you do not want is to think you have a level when you don't. When I have used a SME I was asked question to deterring exactly that, what threats I was willing to accept and what I was not. What attackers we were protecting agains and those we would not protect against such as well funder governments. – zaph May 22 '16 at 23:32
  • @JohnDoe Two factor authentication is having/knowing two of three things: something you know such as a password, something you have such as a smart phone or RSA token and something you are such as a finger or palm print. Having two of these is much more secure than a password.My choice is a token and password, The token has a serial number for control and can not be duplicated. Most of the hosting services support this. If the server is not secure there is no security. You also need backup off the service. Additionally you do not want any keys/passwords in the web root. – zaph May 22 '16 at 23:40
  • An aside: We see lot's of developers come to SO that have little to no encryption experience. We help them get the encryption working. We also turn a blind eye to the fact that they will probably create an insecure solution and we helped. In many case we are complicit in this insecurity. The difference with this question is that it is clear that a secure solution is almost certain not going to happen because of the scope of the question. In example are you sure you will not use CBC mode and not create a padding oracle? It is really easy to make that mistake. – zaph May 22 '16 at 23:47
  • @zaph thank you again for your detailed comment. Could you please explain to me adjust the scope of the question to get a better question? And what is cbc and padding oracle? – John Doe May 23 '16 at 04:59
  • Consider asking on [Cryptography](http://crypto.stackexchange.com). – zaph May 23 '16 at 12:21
  • @zaph thank you very much and have a nice day you helped me a lot – John Doe May 23 '16 at 12:23

0 Answers0