Improving Web Application Security: Threats and - CGISecurity

174 Part III: Building Secure Web ApplicationsCryptographyCryptography is one of the most important tools that you can use to protect data.Encryption can be used to provide data privacy and hash algorithms, which producea fixed and condensed representation of data, can be used to make data tamperproof.Also, digital signatures can be used for authentication purposes.You should use encryption when you want data to be secure in transit or in storage.Some encryption algorithms perform better than others while some provide strongerencryption. Typically, larger encryption key sizes increase security.Two of the most common mistakes made when using cryptography are developingyour own encryption algorithms and failing to secure your encryption keys.Encryption keys must be handled with care. An attacker armed with your encryptionkey can gain access to your encrypted data.The main issues to consider are:● Use platform-provided cryptographic services● Key generation● Key storage● Key exchange● Key maintenanceUse Platform-provided Cryptographic ServicesDo not create your own cryptographic implementations. It is extremely unlikely thatthese implementations will be as secure as the industry standard algorithms providedby the platform; that is, the operating system and the .NET Framework. Managedcode should use the algorithms provided by the System.Security.Cryptographynamespace for encryption, decryption, hashing, random number generating, anddigital signatures.Many of the types in this namespace wrap the operating system CryptoAPI, whileothers implement algorithms in managed code.Key GenerationThe following recommendations apply when you create encryption keys:●●●Generate random keys.Use PasswordDeriveBytes for password-based encryption.Prefer large keys.