0

I have the following requirements regarding encryption of url parameters. As I am newly to encryption I can not figure out how to perform all steps using some c# library. Can anybody help me with example code to perform this steps?

Encrypt Requirements

1 Generate a secret key from the given password.

1) Receive the password which is coupled with the system name. (This is already available)
2) Generate a random nonce in byte-array as the password’s salt which has a length 16-bytes.
3) Set the number of iterations for secret key as 65536.
4) Set the length of secret key as 256-bit (not bytes).
5) Set the algorithm name for key derivation using PBKDF2 with HMAC and SHA-2.
6) Set the algorithm name of key generation as “AES”.
7) Create a secret key with the function of library or tool with all sets above.

2 Encrypt the JSON-string with the above generated secret key.

1) Generate a random nonce in byte-array as the IV (initial vector) which has a length 12-bytes for encryption.
2) Select encrypt mode for the crypto in your function or tool for encryption.
3) Set the name of crypto algorithm which is for AES in GCM mode and without any padding.
4) Set the length of authentication tag for GCM as 128-bits (not bytes).
5) Convert your JSON-string which contains customer information to a byte-array(plainText) with character set UFT-8.
6) Encrypt the plainText with all sets and the secret key in last step to a new byte-array(cipherText)

3 Prefix the generated IV and password’s salt to the cipherText .

1) Create a new byte-array (cipherTextWithIvSalt).
2) Add the 12-bytes IV in cipherTextWithIvSalt at first.
3) Add the 16-bytes password’s salt in cipherTextWithIvSalt after that.
4) Add the cipherText in cipherTextWithIvSalt at last.
5) cipherTextWithIvSalt is now in form “IV + salt + cipherText”

4 Encode the cipherTextWithIvSalt.

1) Encode the cipherTextWithIvSalt to a new byte-array (encodedCipherTextWithIvSalt) by using Base64
  1. Build a displayable encrypted string.
1) Build a new string from byte-array encodedCipherTextWithIvSalt with character set UTF-8.

Thank you in advance!

Anton Klatt
  • 13
  • 5
  • The link above is correct, but this looks like homework or a Computer Science lab assignment. Be careful using code you don't understand and be extra careful about copying code you don't understand. – D M May 18 '21 at 13:22
  • 1
    And be extra _extra_ careful about rolling your own security code. – gunr2171 May 18 '21 at 13:23
  • `I have the following requirements regarding encryption of url parameters` are you concerned with parameter manipulation? – Trevor May 18 '21 at 13:28

0 Answers0