What is the "proper" way to encrypt files in ASP.NET Core?

user_1502310 0
Viewed 646

Let's say we have a requirement that every file users upload to our ASP.NET Core MVC application must be stored in encrypted form in a shared folder, and these files must remain until the user deletes them (so it can be a long time). The shared folder part is not hard, but what's the "proper" way to encrypt uploaded files? What we get when the user uploaded the file is a string with the original file name and a stream with the contents of the file, so that's the starting point but I don't know how to proceed from there.

There are plenty of Google results but all of those use primitives directly on the stream, and I guess there are some glaring security holes when doing that, so there must be a proper way to do so.

file-handling asp.net-core-mvc asp.net-core encryption
1 Answers

"Proper" is a funny word. It really depends how secure you want to be and what you mean by it.

If you want to make sure the file is encrypted over the network, you would want to look into securing your application over TLS with certificates. I assume you're talking about encrypting it once you receive the file, there are a large number of ways, but the way you implement it really depends. A better question is who has access to these files and how can you prevent unauthorized users from accessing someone else's files. If you're giving users direct access to these files on your server, you may want to rethink your approach altogether instead of trying to individually encrypt each file for each user.

This link might be helpful.

Anyway, one option is Symmetric Encryption. It's not the most secure, but simple to implement. Requires key(s) to encrypt and decrypt. You could use one set of keys for every user, but if those keys are compromised every users' files are compromised. On the other hand, you could use separate sets of keys for each user, but that's more to maintain. One of the most popular symmetric encryption algorithms is the Advanced Encryption Standard (AES). .NET Core has libraries from Microsoft for this.

user_46301060
Related