 | |
RSACryptoServiceProvider minimum key-length
Dotnet Security microsoft.public.dotnet.security
 |
| | Thread Tools | Search this Thread | Display Modes |
#11
 
| |||
| |||
|
Re: RSACryptoServiceProvider minimum key-length -
03-13-2007
, 11:44 AM
|
It sounds like you are out of luck then. Like Valery said, this key is so insecure as to be useless and is not supported by .NET cryptography. I'm not sure what options you have. Perhaps an alternate crypto API for .NET supports such weak keys. I'd suggest pushing back on the spec or looking for different options. Joe K. -- Joe Kaplan-MS MVP Directory Services Programming Co-author of "The .NET Developer's Guide to Directory Services Programming"http://www.directoryprogramming.net |
.As about available options for the original poster - the best one
would be to fire the person that did the spec because this kind of
ignorance is really depressive. Person knows nothing about
cryptography, but consider him/her self capable of writting crypto/
security spec.
As I understand - all they wanted is to have a short authentication
code. I'm not even sure that they needed signature as authentication
code, but even for that - there are short signatures available that
simultaneously provide good security bounds. But if they only need
authentication code - they could simply use MAC (or HMAC).
-Valery
http://www.harper.no/valery
#12
| |||
| |||
|
|
On Mar 13, 7:45 am, "Joe Kaplan" joseph.e.kap... (AT) removethis (DOT) accenture.com> wrote: It sounds like you are out of luck then. Like Valery said, this key is so insecure as to be useless and is not supported by .NET cryptography. I'm not sure what options you have. Perhaps an alternate crypto API for .NET supports such weak keys. I'd suggest pushing back on the spec or looking for different options. Joe K. -- Joe Kaplan-MS MVP Directory Services Programming Co-author of "The .NET Developer's Guide to Directory Services Programming"http://www.directoryprogramming.net Thanks Joe for warm wellcomeback .As about available options for the original poster - the best one would be to fire the person that did the spec because this kind of ignorance is really depressive. Person knows nothing about cryptography, but consider him/her self capable of writting crypto/ security spec. As I understand - all they wanted is to have a short authentication code. I'm not even sure that they needed signature as authentication code, but even for that - there are short signatures available that simultaneously provide good security bounds. But if they only need authentication code - they could simply use MAC (or HMAC). -Valeryhttp://www.harper.no/valery |
#13
| |||
| |||
|
|
hi, FYI: we are now using a third-party .net lib (http://www.cryptosys.net/ pki/) which alllows us to use the required key length. seems to work fine... br, pingram. On 13 Mrz., 16:44, "Valery Pryamikov" <val... (AT) harper (DOT) no> wrote: On Mar 13, 7:45 am, "Joe Kaplan" joseph.e.kap... (AT) removethis (DOT) accenture.com> wrote: It sounds like you are out of luck then. Like Valery said, this key is so insecure as to be useless and is not supported by .NET cryptography. I'm not sure what options you have. Perhaps an alternate crypto API for .NET supports such weak keys. I'd suggest pushing back on the spec or looking for different options. Joe K. -- Joe Kaplan-MS MVP Directory Services Programming Co-author of "The .NET Developer's Guide to Directory Services Programming"http://www.directoryprogramming.net Thanks Joe for warm wellcomeback .As about available options for the original poster - the best one would be to fire the person that did the spec because this kind of ignorance is really depressive. Person knows nothing about cryptography, but consider him/her self capable of writting crypto/ security spec. As I understand - all they wanted is to have a short authentication code. I'm not even sure that they needed signature as authentication code, but even for that - there are short signatures available that simultaneously provide good security bounds. But if they only need authentication code - they could simply use MAC (or HMAC). -Valeryhttp://www.harper.no/valery |
|
« Previous Thread
|
Next Thread »
| Thread Tools | Search this Thread |
| Display Modes | |
Linear Mode
| |
Powered by vBulletin Version 3.5.4
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.