Improving Web Application Security: Threats and - CGISecurity

Chapter 7: Building Secure Assemblies 179Protect Exported Private KeysUse PasswordDeriveBytes when you export an Rivest, Shamir, and Adleman (RSA)or Digital Signature Algorithm (DSA) private key. The RSA and DSA classes containa ToXmlString method, which allows you to export the public or private key, or both,from the key container. This method exports the private key in plain text. If youexport the private key to be installed on multiple servers in a Web farm, arecommended method is to encrypt the key after exporting the private key by usingPasswordDeriveBytes to generate a symmetric key as shown in the following codesample.PasswordDeriveBytes deriver = new PasswordDeriveBytes(, null);byte[] ivZeros = new byte[8];//This is not actually used but is currentlyrequired.//Derive key from the passwordbyte[] pbeKey = deriver.CryptDeriveKey("TripleDES", "SHA1", 192, ivZeros);SummaryThis chapter has shown you how to apply various techniques to improve the securityof your managed code. The techniques in this chapter can be applied to all types ofmanaged assemblies including Web pages, controls, utility libraries, and others. Forspecific recommendations that apply to specific types of assemblies, see the otherbuilding chapters in Part III of this guide.To further improve the security of your assemblies, you can use explicit code accesssecurity coding techniques, which are particularly important if your assembliessupport partial trust callers. For more information about using code access security,see Chapter 8, “Code Access Security in Practice.”Additional ResourcesFor additional related reading, refer to the following resources:● For more information about using DPAPI from ASP.NET Web applications, see“How To: Create a DPAPI Library” in the “How To” section of “Microsoft patterns& practices Volume I, Building Secure ASP.NET Applications: Authentication,Authorization, and Secure Communication” at http://msdn.microsoft.com/library/en-us/dnnetsec/html/SecNetHT07.asp.●●For more information about secure coding guidelines for the .NET Framework,see MSDN article, “Secure Coding Guidelines for the .NET Framework,” athttp://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/seccodeguide.asp.Michael Howard discusses techniques for writing secure code and shows youhow to add them in your own applications in his MSDN column, “Code Secure,”at http://msdn.microsoft.com/columns/secure.asp.