Save user and password without using database

4

I'm developing an application with% of type Console , and I'm trying to save some confidential settings like username, password and IP. The problem is, how to store this data securely locally without the use of a database anywhere.

For example, at first I thought about saving this data to an XML, but soon I saw that they would be totally exposed, so I thought about encrypting, but when I use them I need everything decrypted, including the password.

The question is, how to safely store this data in C# ?

    
asked by anonymous 13.05.2015 / 20:54

2 answers

3

Yes, using Triple DES .

This CodeProject article teaches you how to do . If you need, I'll put the code here, translated.

    
13.05.2015 / 20:57
2

You can do this without using a commercial database, but you will end up creating your own "database" and the entire mechanism for reading, writing, and securing your file.

You can instead use an XML file and encrypt the data and serialize a class to XML and then when you need to use it you deserialize that file back to a class.

An even more secure way, instead of using a file in XML format, using a binary format file (.dat, .bin, .cook, and so on) and serializing + encrypt at save and deserialize / decrypt time to read.

An easy idea would be to have a class that already does encryption at the time of saving automatically and the reverse at the time of reading. Example:

public sealed class AccessData {
    private String _username;
    private String _password;
    private String _ipv4;

    [XmlIgnore] //Esta propriedade não irá para o arquivo .XML quando for serializada
    public String UserName {
         get { return _username; }
         set { _username = value; }
    }

    [XmlElement("UserName")] //No XML o valor será armazenado em uma tag "UserName"
    public String UserNameSecure { 
        get { return Security.Encrypt("S3Nh@S3GuR@", _username); }
        set { _username = Security.Decrypt("S3Nh@S3GuR@", value); }
    }

    [XmlIgnore] //Esta propriedade não irá para o arquivo .XML quando for serializada
    public String Password {
         get { return _password; }
         set { _password = value; }
    }

    [XmlElement("Password")] //No XML o valor será armazenado em uma tag "Password"
    public String PasswordSecure { 
        get { return Security.Encrypt("S3Nh@S3GuR@", _password); }
        set { _password = Security.Decrypt("S3Nh@S3GuR@", value); }
    }

      [XmlIgnore] //Esta propriedade não irá para o arquivo .XML quando for serializada
    public String IPV4 {
         get { return _ipv4; }
         set { _ipv4 = value; }
    }

    [XmlElement("IPAddress")] //No XML o valor será armazenado em uma tag "IPAddress"
    public String IPV4Secure { 
        get { return Security.Encrypt("S3Nh@S3GuR@", _ipv4); }
        set { _ipv4 = Security.Decrypt("S3Nh@S3GuR@", value); }
    }
}

internal static class Security {
    private const String SaltKey = "umaStringDeSalt";
    private const String ViKey = "UmaChaveQualquer";

    public static String Encrypt(String password, String value){
        byte[] plainTextBytes = Encoding.UTF8.GetBytes(value);

        byte[] keyBytes = new Rfc2898DeriveBytes(password, Encoding.ASCII.GetBytes(SaltKey)).GetBytes(256 / 8);
        var symmetricKey = new RijndaelManaged { Mode = CipherMode.CBC, Padding = PaddingMode.Zeros };
        var encryptor = symmetricKey.CreateEncryptor(keyBytes, Encoding.ASCII.GetBytes(ViKey));

        byte[] cipherTextBytes;

        using (var memoryStream = new MemoryStream())
        {
            using (var cryptoStream = new CryptoStream(memoryStream, encryptor, CryptoStreamMode.Write))
            {
                cryptoStream.Write(plainTextBytes, 0, plainTextBytes.Length);
                cryptoStream.FlushFinalBlock();
                cipherTextBytes = memoryStream.ToArray();
                cryptoStream.Close();
            }
            memoryStream.Close();
        }
        return Convert.ToBase64String(cipherTextBytes);
    }

    public static String Decrypt(String password, String value)
    {
        byte[] cipherTextBytes = Convert.FromBase64String(value);
        byte[] keyBytes = new Rfc2898DeriveBytes(password, Encoding.ASCII.GetBytes(SaltKey)).GetBytes(256 / 8);
        var symmetricKey = new RijndaelManaged { Mode = CipherMode.CBC, Padding = PaddingMode.None };

        var decryptor = symmetricKey.CreateDecryptor(keyBytes, Encoding.ASCII.GetBytes(ViKey));
        var memoryStream = new MemoryStream(cipherTextBytes);
        var cryptoStream = new CryptoStream(memoryStream, decryptor, CryptoStreamMode.Read);
        var plainTextBytes = new byte[cipherTextBytes.Length];

        int decryptedByteCount = cryptoStream.Read(plainTextBytes, 0, plainTextBytes.Length);
        memoryStream.Close();
        cryptoStream.Close();
        return Encoding.UTF8.GetString(plainTextBytes, 0, decryptedByteCount).TrimEnd("
var objeto = new AccessData();
objeto.Username = "Guilherme";
objeto.Password = "123456";
objeto.IPV4 = "192.168.1.1";   
var serializer = new SerializationHelper(); //classe que você irá criar para serializar arquivos XML.
serializer.Save("dadosDeAcesso.xml",objeto); //um método "Save" deverá salvar um objeto qualquer (objeto) em um arquivo qualquer (dadosDeAcesso.xml)
".ToCharArray()); } }

Note that the class properties are Username, Password, and IPV4 These are the properties you will use in your code. The UsernameSecure, PasswordSecure, and IPV4Secure properties are only for serialization for XML, note that they encrypt and decrypt the data.

An example usage:

public sealed class AccessData {
    private String _username;
    private String _password;
    private String _ipv4;

    [XmlIgnore] //Esta propriedade não irá para o arquivo .XML quando for serializada
    public String UserName {
         get { return _username; }
         set { _username = value; }
    }

    [XmlElement("UserName")] //No XML o valor será armazenado em uma tag "UserName"
    public String UserNameSecure { 
        get { return Security.Encrypt("S3Nh@S3GuR@", _username); }
        set { _username = Security.Decrypt("S3Nh@S3GuR@", value); }
    }

    [XmlIgnore] //Esta propriedade não irá para o arquivo .XML quando for serializada
    public String Password {
         get { return _password; }
         set { _password = value; }
    }

    [XmlElement("Password")] //No XML o valor será armazenado em uma tag "Password"
    public String PasswordSecure { 
        get { return Security.Encrypt("S3Nh@S3GuR@", _password); }
        set { _password = Security.Decrypt("S3Nh@S3GuR@", value); }
    }

      [XmlIgnore] //Esta propriedade não irá para o arquivo .XML quando for serializada
    public String IPV4 {
         get { return _ipv4; }
         set { _ipv4 = value; }
    }

    [XmlElement("IPAddress")] //No XML o valor será armazenado em uma tag "IPAddress"
    public String IPV4Secure { 
        get { return Security.Encrypt("S3Nh@S3GuR@", _ipv4); }
        set { _ipv4 = Security.Decrypt("S3Nh@S3GuR@", value); }
    }
}

internal static class Security {
    private const String SaltKey = "umaStringDeSalt";
    private const String ViKey = "UmaChaveQualquer";

    public static String Encrypt(String password, String value){
        byte[] plainTextBytes = Encoding.UTF8.GetBytes(value);

        byte[] keyBytes = new Rfc2898DeriveBytes(password, Encoding.ASCII.GetBytes(SaltKey)).GetBytes(256 / 8);
        var symmetricKey = new RijndaelManaged { Mode = CipherMode.CBC, Padding = PaddingMode.Zeros };
        var encryptor = symmetricKey.CreateEncryptor(keyBytes, Encoding.ASCII.GetBytes(ViKey));

        byte[] cipherTextBytes;

        using (var memoryStream = new MemoryStream())
        {
            using (var cryptoStream = new CryptoStream(memoryStream, encryptor, CryptoStreamMode.Write))
            {
                cryptoStream.Write(plainTextBytes, 0, plainTextBytes.Length);
                cryptoStream.FlushFinalBlock();
                cipherTextBytes = memoryStream.ToArray();
                cryptoStream.Close();
            }
            memoryStream.Close();
        }
        return Convert.ToBase64String(cipherTextBytes);
    }

    public static String Decrypt(String password, String value)
    {
        byte[] cipherTextBytes = Convert.FromBase64String(value);
        byte[] keyBytes = new Rfc2898DeriveBytes(password, Encoding.ASCII.GetBytes(SaltKey)).GetBytes(256 / 8);
        var symmetricKey = new RijndaelManaged { Mode = CipherMode.CBC, Padding = PaddingMode.None };

        var decryptor = symmetricKey.CreateDecryptor(keyBytes, Encoding.ASCII.GetBytes(ViKey));
        var memoryStream = new MemoryStream(cipherTextBytes);
        var cryptoStream = new CryptoStream(memoryStream, decryptor, CryptoStreamMode.Read);
        var plainTextBytes = new byte[cipherTextBytes.Length];

        int decryptedByteCount = cryptoStream.Read(plainTextBytes, 0, plainTextBytes.Length);
        memoryStream.Close();
        cryptoStream.Close();
        return Encoding.UTF8.GetString(plainTextBytes, 0, decryptedByteCount).TrimEnd("
var objeto = new AccessData();
objeto.Username = "Guilherme";
objeto.Password = "123456";
objeto.IPV4 = "192.168.1.1";   
var serializer = new SerializationHelper(); //classe que você irá criar para serializar arquivos XML.
serializer.Save("dadosDeAcesso.xml",objeto); //um método "Save" deverá salvar um objeto qualquer (objeto) em um arquivo qualquer (dadosDeAcesso.xml)
".ToCharArray()); } }

How to serialize a class to XML and an XML file

Serialize a Class to an XML File

Serialize a Class to XML

    
28.05.2015 / 15:59