Why does TripleDes use exactly 16 bytes from Rfc2898DeriveBytes?

Question

Rfc2898DeriveBytes k1 = new Rfc2898DeriveBytes(pwd1, salt1, myIterations);

Rfc2898DeriveBytes k2 = new Rfc2898DeriveBytes(pwd1, salt1);

// Encrypt the data.
TripleDES encAlg = TripleDES.Create();
encAlg.Key = k1.GetBytes(16);

My question is why is .GetByte 16? Also is it the same for RijndaelManaged? it requires 16 bytes?

Answer 1

It is because of the size of the key needed to the algorithm:

• TriplDES, depending on the mode, needs either 128(16 bytes) or 196 bits - 3DES Key Size Matter in C#.Net.
• Rjindael needs 128 or 256 bits - RijndaelManaged supports 128-256 bit key, what key size the default constructor generator?

Of course, nothing stops you from generating more bytes from key derivator, but these algorithms will either trim the unneeded data or just plain fail to work if the size is not legal - http://msdn.microsoft.com/en-us/library/system.security.cryptography.symmetricalgorithm.legalkeysizes(v=vs.110).aspx.