C# Byte[] Encryption

Question

I have a Byte[] field that is a file contents that I need to encrypt. Nothing special or fancy, just enough to make sure the next person who gets it won't be able to easily decode it without some effort. I would use the encryption that comes with .Net Framework 4.0 but I definitely do not need to make the file any bigger than it is.

I thought about just simply reversing the array or adding a few bytes to the end...?

If I can avoid making the array to much bigger that would be great.

Any suggestions?

Thanks!

Answer 1

Does the addition of 1-16 bytes hurt? AES will pad by default using the below method:

    private static void EncryptThenDecrypt(byte[] msg)
    {
        byte[] message = msg; // fill with your bytes

        if (message is null)
        {
            return;
        }

        byte[] encMessage; // the encrypted bytes
        byte[] decMessage; // the decrypted bytes - s/b same as message
        byte[] key;
        byte[] iv;

        using (SymmetricAlgorithm aes = Aes.Create())
        {
            if (aes is null)
            {
                iv = key = null;
                encMessage = Array.Empty<byte>();
            }
            else
            {
                aes.GenerateKey();
                aes.GenerateIV();
                key = aes.Key;
                iv = aes.IV;
                encMessage = EncryptBytes(aes, message);
            }
        }

        using (SymmetricAlgorithm aes = Aes.Create())
        {
            if (aes is null || key is null)
            {
                decMessage = Array.Empty<byte>();
            }
            else
            {
                aes.Key = key;
                aes.IV = iv;
                decMessage = DecryptBytes(aes, encMessage);
            }
        }

        Debug.Assert(message.SequenceEqual(decMessage), "Decrypted bytes do not match original bytes.");
    }

    private static byte[] EncryptBytes(SymmetricAlgorithm alg, byte[] message)
    {
        if (message is null)
        {
#pragma warning disable S1168 // Empty arrays and collections should be returned instead of null
            return null;
#pragma warning restore S1168 // Empty arrays and collections should be returned instead of null
        }

        if (message.Length == 0)
        {
            return message;
        }

        if (alg is null)
        {
            throw new ArgumentNullException(nameof(alg));
        }

        using (MemoryStream stream = new MemoryStream())
        using (ICryptoTransform encryptor = alg.CreateEncryptor())
        using (CryptoStream encrypt = new CryptoStream(stream, encryptor, CryptoStreamMode.Write))
        {
            encrypt.Write(message, 0, message.Length);
            encrypt.FlushFinalBlock();
            return stream.ToArray();
        }
    }

    private static byte[] DecryptBytes(SymmetricAlgorithm alg, byte[] message)
    {
        if (message is null)
        {
#pragma warning disable S1168 // Empty arrays and collections should be returned instead of null
            return null;
#pragma warning restore S1168 // Empty arrays and collections should be returned instead of null
        }

        if (message.Length == 0)
        {
            return message;
        }

        if (alg is null)
        {
            throw new ArgumentNullException(nameof(alg));
        }

        using (MemoryStream stream = new MemoryStream())
        using (ICryptoTransform decryptor = alg.CreateDecryptor())
        using (CryptoStream encrypt = new CryptoStream(stream, decryptor, CryptoStreamMode.Write))
        {
            encrypt.Write(message, 0, message.Length);
            encrypt.FlushFinalBlock();
            return stream.ToArray();
        }
    }

Answer 2

Don't invent your own Encryption mechanism (i.e. Security by Obfuscation), use one of the classes provided by the framework.