How to Encrypt Plain Text in C# With AES

[zfold]

What I always do is append a timestamp to the value that is to be encrypted. My decrypt then uses that timestamp to validate a time window. My encrypted string typically expire after 15 minutes. It protects me to great extent from people trying to replay query strings or request bodies.
Of course, there are scenarios where you can not use this approach.

[diadetediotedio]

I recommend using a state-of-the-art cryptography lib like libsodium with the recommended security defaults of the implementation instead of manually using AES, but it is pretty good as well.

[husler]

When to persist data on disk and when to persist on database?

[RoyZASTEROiD]

when we need these, can you give few situation examples?

[JoeEnos]

The key is stored in config as a UTF8 string that you’re converting into bytes. Should be a fixed number of arbitrary bytes stored as hex or base64.

[quanlien]

what is the name of the theme that ur using

[XD-idjj]

That’s very bad example, IV must never be reused with the same key. It should be created in Encrypt function and returned with cipher text

[Kirides]

The IV of an AES cipher should never be re-used, thus storing it inside a configuration would be one of the worst things to ever do.

i know, doing encryption properly is hard, but showing off how to do it wrong is not helping it.