Best way to store Encryption Key and IV(Initialization Vector) with AES

Question

Best way to store Encryption Key and IV(Initialization Vector) with AES

Pughazendhi Chandrakasan 1

As a result of the Veracode security scan, the Encryption Key and IV were found to be hard-coded in the code. For encryption, we are also using the old TripleDES algorithm.

In this case, we must remove the hard-coded key and IV and also update to the AES algorithm. This is a utility class that will be used throughout the application (in Web application, Windows application and WCF services)

Hard code key and IV in Encryption class

User's image

It is a legacy application that has recently been moved to AzureDevops. The process of removing hard-coded keys and implementing a new encryption standard presents some challenges.

1.The best way to store the encryption key and IV securely is local/store in files.

2.We don't have option to store in AzureKeyValut and use Environment Variable.

3.Also Client not accepting to store Key & IV store in Web.Config and Database.

Encryption & Decryption mostly used for login and also encrypting some data at runtime.
Mostly use Powershell scripts for automation tasks.

I have chosen AES CBC Mode symmetric algorithm for server side encryption. But Not sure how to deal encryption key storage.

What are the best approaches/secure ways to store the Key & IV locally or any other options available?

Please assist and share helpful thoughts.

Thanks in advance.

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

1 answer

Your answer

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer 1

Bruce (SqlWork.com) 83,821

for old asp.net, IIS encryption services is probably best:

https://learn.microsoft.com/en-us/previous-versions/aspnet/zhhddkxy(v=vs.100)

Pughazendhi Chandrakasan 1 Reputation point

2024-03-06T07:24:26.0366667+00:00

Is any other option instead of storing it in web.config, Azurekey vault or in database?

This is not only for asp.net . This is actually a generic utility class. The same encryption functionality used in Windows application, WCF various application
Bruce (SqlWork.com) 83,821 Reputation points

2024-03-08T17:26:28.13+00:00

you can use azure key vault, but storing the key vault credentials will cause a similar issue. you can use sqlserver encryption services. this has the advantage that access is by user credentials and the user will not have access to the keys, only encrypt and decrypt.
Pughazendhi Chandrakasan 1 Reputation point

2024-03-11T08:34:55.8666667+00:00

Could you please provide sample code using sql server encryption or how to do?

Thanks

Bruce (SqlWork.com) 83,821

see docs to create a symmetric key:

https://learn.microsoft.com/en-us/sql/t-sql/statements/create-symmetric-key-transact-sql?view=sql-server-ver16

then:

create procedure [dbo].[EncryptData]
    @data varchar(1000)
as
    declare @encryptedData varbinary(8000)
    open symmetric key MySecureKey
       decryption by certificate MySecureCert
    set @encryptedData = EncryptByKey(key_guid('MySecureKey'),@data)
    select @encryptedData as EncryptedValue
    close symmetric key MySecureKey
go

create procedure [dbo].[DecryptData]
   @encryptedData varbinary(8000)
as
   open symmetric key MySecureKey
       decryption by certificate MySecureCert
   select convert(varchar(1000),DecryptByKey(@encryptedData)) as DecryptedValue
   close symmetric key MySecureKey
go

typically in code, you'd convert the binary to base64 or base64url.

Share via

Best way to store Encryption Key and IV(Initialization Vector) with AES

1 answer

Your answer