«

I'm trying to encrypt a part of a url as follows:

test.aspx?id=123&check=abc

Basically, I'm using TripleDes encryption to encrypt the id, then include
this as check in the url to prevent tampering. I'm working from some code
from http://www.15seconds.com/Issue/021210.htm

It seems to work fine except a few seem to through up problems as follows:

Invalid character in a Base-64 string

Line 83:
Line 84: 'convert from string to byte array
Line 85: Dim buffer As Byte() = Convert.FromBase64String(value)
Line 86: Dim ms As MemoryStream = New MemoryStream(buffer)
Line 87: Dim cs As CryptoStream = New CryptoStream(ms,
cryptoProvider.CreateDecryptor(KEY_192, IV_192), CryptoStreamMode.Read)


An example ID that throws up a problem is 1026 which gives the check
eIn9iD3i+JE=

I'm guessing it is to do with the + sign, but even when urlencoded it gives
the same error.

I can post more code if needed... but any advice would be great. Is there a
better / more reliable way to encrypt?

Cheers

the + decodes to a space (as spaces are not allowed in a url).
urlencoding leaves it alone. you will need manually convert it to "%2b"
after performing a urlencode.

-- bruce (sqlwork.com)

James wrote:
> I'm trying to encrypt a part of a url as follows:
>
> test.aspx?id=123&check=abc
>
> Basically, I'm using TripleDes encryption to encrypt the id, then include
> this as check in the url to prevent tampering. I'm working from some code
> from http://www.15seconds.com/Issue/021210.htm
>
> It seems to work fine except a few seem to through up problems as follows:
>
> Invalid character in a Base-64 string
>
> Line 83:
> Line 84: 'convert from string to byte array
> Line 85: Dim buffer As Byte() = Convert.FromBase64String(value)
> Line 86: Dim ms As MemoryStream = New MemoryStream(buffer)
> Line 87: Dim cs As CryptoStream = New CryptoStream(ms,
> cryptoProvider.CreateDecryptor(KEY_192, IV_192), CryptoStreamMode.Read)
>
>
> An example ID that throws up a problem is 1026 which gives the check
> eIn9iD3i+JE=
>
> I'm guessing it is to do with the + sign, but even when urlencoded it gives
> the same error.
>
> I can post more code if needed... but any advice would be great. Is there a
> better / more reliable way to encrypt?
>
> Cheers

bruce barker wrote:
> the + decodes to a space (as spaces are not allowed in a url).
> urlencoding leaves it alone. you will need manually convert it to "%2b"
> after performing a urlencode.
>
> -- bruce (sqlwork.com)
>

I tested this to be really sure, and it works exactly as I though it
would. Using UrlEncode on a string containing a + does encode it into
%2b. There is no need to do it manually.

--
Göran Andersson
_____
http://www.guffa.com