3

Encryption is not my forté.

I'm writing an application in Silverlight 3 which communicates with a web service to authenticate users. The web service won't necessarily be hosted under SSL. I'm trying to find a way to reversibly encrypt the user name and password before passing them which doesn't rely on the key and salt being hard-coded into the Silverlight assembly. It doesn't support RSA (or any asymmetric algorithm), so I can't use a public key from the server.

Are there any patterns for doing this sort of thing?

3 Answers 3

5

RSA would really be the best way to go here, but indeed there's no implementation in either the Silverlight 2 or 3 libraries. It's something that really should have been added in my opinion, though it's very unlikely to happen until Silverlight 4 now. Unfortunately, a custom RSA implementation is likely to be truly painful, so it's not quite feasible I'd expect.

Here is my proposed solution... It's certainly not as simple as simply sending the public key from the server, but it should do the job securely still.

  1. Use the Diffie-Hellman key exchange algorithm to agree on a key to be used for later encrypted. This was designed to work over an insecure channel, so there are no problems here. See here for a C# implementation.
  2. Use some sort symmetric encryption with the key established by the Diffie-Hellman exchange to send the username/password over the connection. The server can then decrypt using the same key, which while known to both the client and server, are nonetheless unknown to any third party. The strength of your symmetric encryption algorithm should not in fact matter in this case. (Someone correct me if I'm wrong.) A simple XOR cipher should do the job in fact. It seems you could also use the AES standard, which is included in the System.Security.Cryptography namespace of the Silverlight BCL.

Hope that helps. Let me know if you're not clear on any of the points.

3
  • That looks ideal. I'll give it a go this evening. May 19, 2009 at 18:41
  • Ok, good luck! Just to add that if that implementation of Diffie-Hellman I linked to doesn't work well, you can try the implementation I wrote as part of my Windows SSH Server project: code.launchpad.net/windows-ssh-server
    – Noldorin
    May 19, 2009 at 19:06
  • So I take it this requires a Diffie-Hellman implementation on the Silverlight client-side as well? Are there any implementations for this without having to rewrite everything to compile for SL?
    – Peet Brits
    Nov 8, 2010 at 14:49
2

Here is a library with open source for RSA encryption in Silverlight http://www.riawebsoft.ru/Silverlight/Rsa/Test.aspx

0

I've released an RSA library that's compatible with the .NET RSACryptoServiceProvider (both PKCS and OAEP) and is compliant with RSA Standards. It's open source:

http://scrypt.codeplex.com

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.