Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
5.3.3 Receiving Message
The data archiving system will continue to listen and accept messages (see Figure 28)
that have been received from the client until the client disconnects. All the messages
that are received are passed through to the decrypt class, where the data archiving
systems private key is applied to the cipher text and thus decrypting it back to plain
text.
while (true)
{
// Specify the size of the packet.
data = new byte[10240];
// Accept the packet from the Client.
recv = client.Receive(data);
// If the Client disconnects then exit.
if (recv == 0)
break;
}
// Send the packet back to the Client.
client.Send(data, recv, SocketFlags.None);
Figure 28: Receiving a Message
5.3.4 Decrypting Message
Figure 29 shows the code that is used to decrypt the received message; the code for it
is from a program by Mathew Schlabaugh on the codeproject.com which can be found
at (http://www.codeproject.com/KB/security/RSACryptoPad.aspx).
// Convert the encrypted message back into a string
string encryptedMessage = Encoding.ASCII.GetString(data, 0, recv);
// Use the private key to decrypt the message
RSAProvider.FromXmlString(publicAndPrivateKeys);
int base64BlockSize = ((dwKeySize / 8) % 3 != 0) (((dwKeySize / 8)
/ 3) * 4) + 4 : ((dwKeySize / 8) / 3) * 4;
// Break the message apart into blocks.
int iterations = encryptedMessage.Length / base64BlockSize;
ArrayList arrayList = new ArrayList();
for (int i = 0; i < iterations ; i++)
{
byte[] encryptedBytes =
Convert.FromBase64String(encryptedMessage.Substring(base64BlockSize *
i, base64BlockSize));
arrayList.AddRange(RSAProvider.Decrypt(encryptedBytes, true));
}
// Convert the decrypted message to a string.
string decryptedMessage =
Encoding.UTF32.GetString(arrayList.ToArray(Type.GetType("System.Byte"
)) as byte[]);
decryptedMessage = "" + DateTime.Now + "" +
decryptedMessage;
Figure 29: Decrypting a message
46