尝试创建一个256位密钥存储在web.config中

Question

I am trying to create a 256bit key and use this in AES encryption, and I need to store this in my web.config file so it has to be converted to a string.

The crypt library I am using is: https://gist.githubusercontent.com/jbtule/4336842/raw/8da408b55fe9f94adb3319ed6491897d0ebac790/AESThenHMAC.cs

So for example the method signature looks like:

public static string SimpleEncrypt(string secretMessage, byte[] cryptKey, byte[] authKey,
                                           byte[] nonSecretPayload = null)

I tried the following but it is returning funny characters:

var hmac = new HMACSHA256();
var keyHex = System.Text.Encoding.UTF8.GetString(hmac.Key);

I will need to create a similiar secret key which will be the same process since it is 256bit also and I need to store in the web.conf file.

Hoping someone can help me

Answer 1

As a general rule, when there is a need to store arbitrary binary data as text (eg, having a byte array stored as a text in a property file), then a more portable form of the binary data should be used.

There is a number of those, and the use depends on developer preferences, intended use, performance concerns, etc.

The most commonly nowadays used format for portable storage of binary data as text is Base 64 ( https://en.wikipedia.org/wiki/Base64 ). You should convert the bytes to a Base64 string when storing it into a text file, and convert it back into bytes when loading it into your code.

In C#, the implementation to use would vary depending on the actual platform, plus you can always find a number of libraries that would provide this implementation. For example, in certain versions of .NET framework you can use https://msdn.microsoft.com/en-us/library/dhx0d524(v=vs.110).aspx and https://msdn.microsoft.com/en-us/library/system.convert.frombase64string(v=vs.110).aspx

Answer 2

You ask the class for the key it uses to instantiate HMACSHA256. The Key property of HMACSHA256 reads:

Gets or sets the key to use in the hash algorithm. (Inherited from HMAC.)

If no key is specified .NET classes will generate their own random key. That is however the key used as input parameter for the HMAC function (which can take keys of any size), not the output of the HMAC, which will be 256 bit.

If you want a newly generated key you should use an instance of RNGCryptoServiceProvider instead to generate a random key of 256 bits (32 bytes). Then you can use these bytes directly as key value in the AES class you are using.

If you want to store the key as text you need to encode it as hexadecimals or base 64. If you view it directly as text you will get random ("funny") characters, and that's only if the bytes can be displayed as printable characters at all.