Chris May

This article from MSDN talks a lot about utilizing the viewstate to its fullest.

One of the things that they discuss is security, and encrypting the viewstate.

Here is a simple example for using a hashing sequence to protect passwords.

Secure Querystrings is something that I have seen in practice, but I didn't know that it was built into the .NET Framework. Pretty cool.

Just convert this into a BAT file:

cd program files
cd microsoft visual studio .net 2003
cd common7
cd tools
cd bin


makecert -r -pe -n "CN=users.walshgroup.com" -b 01/01/2000 -e 01/01/2036 -eku 1.3.6.1.5.5.7.3.1 -ss my -sr localMachine -sky exchange -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12 usersCert.cer
echo finished



After you have the cer file, you need to do the following.

Export a Certificate and Public Key
Now that you have added the Certificates snap-in, you can export the key pair that your Web server is using (the certificate and public key). To do this, perform the following steps: Open the Certificates (Local Computer) snap-in you added in the last section, navigate to Personal, and then to Certificates.

You will see your Web server certificate denoted by the CN (Common Name) found in the Subject field of the certificate (using Internet Explorer 5.0, you can easily view the certificate to see the Common Name if you are unsure).

Right-click on the server certificate, select All Tasks, and then click Export.

When the wizard starts, click Next. Choose to export the private key, and then click Next. NOTE: If you export the certificate for use on an IIS Web server, do not select Require Strong Encryption. This option causes a password prompt every time an application attempts to access the private key, and causes IIS to fail.


The file format you will want to choose is the Personal Information Exchange (though you can select from several options). This will create a PFX file. Notice that you can export any certificates in the certification path by selecting the option on this screen. This is very handy if your certificate was issued by a non-trusted certificate authority (for example, Microsoft Certificate Server). Only choose delete the private key if the export is successful to be sure it is not left on the computer (for example if your migrating from one server to another).NOTE: If you do not select "Include all certificates in the certificate path if possible" and the issuer of the certificate is not trusted by your server, then you may notice that when the properties of the certificate are viewed, the "This certificate is issued to:" field may display "Windows does not have enough information about this certificate". This is by design and can be resolved by selecting "Include all certificates in the certificate path" while exporting the certificate.


The just import the file into IIS.



For more info, check out these urls http://www.inventec.ch/chdh/notes/14.htm and http://support.microsoft.com/default.aspx?scid=kb;EN-US;232136.

I've been working on some stuff with Flash and cryptography.

This site has some source code that implements the SHA1 hash method to produce a "one way" encryption method.

Here is an example of the RSA public key / private key encryption method if flash. (This won't work if you have Flash6 plugin, but once you recompile the source code, it works fine.)

This article shows how to store passwords and connection strings securly on your machine.