secret key string visible in dll

[Tim Mackey]

hi,
i am using 3des encryption with a secret key to send information between 2 aspnet applications. they both know the key, which is a hard-coded string. i have read about using aspnet-setreg to securely store such a value in the registry, but i have a different query.
if i open the dll in notepad, i can read the secret key, which obviously is no good. i tried changing the code to use a number as the secret key, calling .ToString() on the number. I then recompile and open up the dll in notepad and i can't find the number, which seems better. i don't know a thing about disassembling .net executables, so i'd like to know if the key is safe, hard-coded in the dll, in numeric form?

granted a numeric key has less combinations than a string version, but adding more digits will go some of the way to help that.

thanks for any help
tim mackey.

[Joe Kaplan \(MVP - ADSI\)]

With a tool like Reflector or Anakrino, it would be trivially easy to
decompile your assembly to discover how you are getting the key if it is
hard coded in the assembly. However, if you can protect access to the
assembly, then this may still be safe. It really depends on who will have
access to it.

Storing secrets is a very hard problem

Joe K.

"Tim Mackey" <anonymous@discussions.microsoft.com> wrote in message
news:7A875CEA-DD4E-4DB8-8397-3D6FC41F06AC@microsoft.com...

> hi,
> i am using 3des encryption with a secret key to send information between 2

aspnet applications. they both know the key, which is a hard-coded string.
i have read about using aspnet-setreg to securely store such a value in the
registry, but i have a different query.

> if i open the dll in notepad, i can read the secret key, which obviously

is no good. i tried changing the code to use a number as the secret key,
calling .ToString() on the number. I then recompile and open up the dll in
notepad and i can't find the number, which seems better. i don't know a
thing about disassembling .net executables, so i'd like to know if the key
is safe, hard-coded in the dll, in numeric form?

>
> granted a numeric key has less combinations than a string version, but

adding more digits will go some of the way to help that.

>
> thanks for any help
> tim mackey.

[Tim Mackey]

Hi Joe,
many thanks for the clarification. i thought i might have stumbled on a good way of storing secret keys, as numbers, but it's re-assuring to hear from an expert that it still wouldn't be secure if access to the assembly file was compromised.

cheer
ti