Basic encrypting of data written to a flat file

[mcapone888]

Hi everyone. I am not a programmer. I have researched my issue online, and it seems many of the solutions are over my head. I took a few VB courses in college, but that was back 1996. I hope someone out there could help me with a 'dumbed down' solution.

I have your typical VB.Net app which writes public variables to a flat text file. It also loads them the next time the app is executed. The functionality works great, but the data is right there in plain sight. Anyone can open the .txt file and change the values.

I know there could always be someone out there determined enough to access data you do not want them to, but I am not trying to secure government secrets. But at the same time, I would like some level of protection on this data so you could not simply open up the .txt file and simply change the data.

Is there an easy way to encrypt the values before saving, and then decrypt them when loading? I believe I messed around with PHP a while back and I would use MD5 (is that right?) when inserting a password to the database. Is there something that easy in .Net?

Here is my code. I know it is bad. Like I said, I am not a programmer. I am just trying to write some practice tests for my son and store his scores in a text file so I can view them later. Maybe there is something I can add in front of the WriteLines and ReadLines? Thanks for any advice:

Module SaveData
    Public Sub Save()
        Dim FILE_NAME As String
        FILE_NAME = "data\data.txt"
        If System.IO.File.Exists(FILE_NAME) = True Then
            Dim objWriter As New System.IO.StreamWriter(FILE_NAME)
            objWriter.WriteLine(Test1)
            objWriter.WriteLine(Grade1)
            objWriter.Close()
        Else
            MsgBox("File Does Not Exist")
        End If
    End Sub
End Module

Module LoadData
    Public Sub Load()
        Dim FILE_NAME As String
        FILE_NAME = "data\data.txt"
        If System.IO.File.Exists(FILE_NAME) = True Then
            Dim objReader As New System.IO.StreamReader(FILE_NAME)
            Test1 = objReader.ReadLine
            Grade1 = objReader.ReadLine
            objReader.Close()
        Else
            MsgBox("File Does Not Exist")
        End If
    End Sub
End Module

 

[jmcilhinney]

.NET Streams have been designed in such a way as they can be stacked on top of each other. You are using a StreamWriter, which writes to a Stream, and a StreamReader, which reads from a Stream. The most common type of Stream to write to and read from is a FileStream, and that's what happens when you just pass a file path to the constructor. This code:

Using writer As New StreamWriter(filePath)
    '...
End Using

is effectively the same as this code:

Using file As New FileStream(filePath, FileMode.OpenOrCreate),
      writer As New StreamWriter(file)
    '...
End Using

In the first instance the FileStream is created implicitly by the StreamWriter while in the second instance the FileStream is create explicitly in code. That second StreamWriter will accept any type of Stream, not just a FileStream. If you wanted to write text to a network connection you could use a NetworkStream. If you wanted to store text in memory then you can use a MemoryStream. Some Streams are designed specifically to sit on top of other Streams and transform the data as it flows through. Both the GZipStream and CryptoStream do that, for compression and encryption respectively. You could even use both, i.e. you could create a FileStream first, then create a CryptoStream and pass it the FileStream, then create a GZipStream and pass it the CryptoStream, then create a StreamWriter and pass it the GZipStream. You would then just write text to the StreamWriter as normal, which would internally convert the text to Bytes and pass that data to the GZipStream, which would compress those Bytes and pass that data on to the CryptoStream, which would encrypt that data and pass it on the the FileStream, which would write that data to the file.

In your case, you need to use that layered approach but you don't need the GZipStream, so only three layers. That would look something like this:

Using file As New FileStream(filePath, FileMode.OpenOrCreate),
      encryptor As New CryptoStream(file, transform, CryptoStreamMode.Write),
      writer As New StreamWriter(encryptor)
    '...
End Using

You will then need to create the 'transform' to pass in to the CryptoStream constructor. You will be able to find examples of doing that online, e.g. create an instance of the RijndaelManaged class, set the appropriate properties and then call CreateEncryptor if you want to write and CreateDecryptor if you want to read.