2

I'm new to the .NET CryptoProvider space, and am a little concerned by what I have seen regarding the repeated creation of the same key by the RSACryptoProvider. I am using a container because I am storing the key off to file on the server, like so (I export the CspBlob subsequent to this creation and reimport it later)...

_cp = new CspParameters { KeyContainerName = ContainerName };

In this case the ContainerName has a hardcoded value that I reference the container by. What's bothering me is that when I create the RSACryptoProvider, and by exentsion the key pair, the generated key values are always the same!

RSACryptoServiceProvider rsa = new RSACryptoServiceProvider(RSAKeySize, _cp);

If I change the name of the container, the key changes. There must be SOME other source of randomness than the container name when you create an RSACryptoProvider, right? Otherwise that makes the name of the container a password, which is not my intention.

2 Answers 2

2

It's the name of a container, not of a generator.

If you want different keys each time, just create a new CryptoServiceProvider w/o referencing a container( == stored key-pair).

3
  • Right. So if I know the name of the container, I can recreate the same keypair anywhere?! That's awful security. That makes the name of the container a password.
    – Bob
    Jul 15, 2010 at 14:02
  • @Bob. Er... no. The container by that name is stored in the computer's profile Application Data directory. If you open that container by name on the same computer, it will show you the key(s) inside. If you try to open it on another computer, there's nothing to fetch. The computer automagically generated the key the first time you used the container, and is keeping it safe for you for next time you need it. As @Henk suggested, there are other ways to get a new key.
    – ewall
    Jul 15, 2010 at 14:24
  • Good, got it. That's all I needed. The key's randomness is attached to my profile and the container name. That works for me. Thank you.
    – Bob
    Jul 15, 2010 at 14:46
0

Following code will delete the key(if exist) related with the containername. After you delete the key; you can create a new one with the same conatiner name and you will get new random key.

            CspParameters cspParams = new CspParameters();
            // Specify the container name using the passed variable.
            cspParams.KeyContainerName = ContainerName;

            //Create a new instance of RSACryptoServiceProvider. 
            //Pass the CspParameters class to use the 
            //key in the container.
            RSACryptoServiceProvider rsa = new RSACryptoServiceProvider(cspParams);

            //Delete the key entry in the container.
            rsa.PersistKeyInCsp = false;

            //Call Clear to release resources and delete the key from the container.
            rsa.Clear();

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.