title: Storing sensitive data with WebApi and SQL Server
body: <p>I know that its been something common asking about Cryptography and in some cases it is relative the way that it should be. I'm not a Expertise of Encryption but I'm trying to create something that requires a manipulate Credit Cards information and personal too. Currently I'm using WebApi and after researching about it, I found this method the "reliable", at least it seems. So this could be my Main Encryption base on your's Experience on this matter ? It is Rijndael!</p>
  
  <p>This is my code :</p>
  
  <pre><code>public class Encryption
  {
      internal const string Inputkey = "A GUID";
  
      public static string EncryptRijndael(string text, string salt)
      {
          if (string.IsNullOrEmpty(text))
              throw new ArgumentNullException("text");
  
          var aesAlg = NewRijndaelManaged(salt);
  
          var encryptor = aesAlg.CreateEncryptor(aesAlg.Key, aesAlg.IV);
          var msEncrypt = new MemoryStream();
          using (var csEncrypt = new CryptoStream(msEncrypt, encryptor, CryptoStreamMode.Write))
          using (var swEncrypt = new StreamWriter(csEncrypt))
          {
              swEncrypt.Write(text);
          }
  
          return Convert.ToBase64String(msEncrypt.ToArray());
      }
      public static bool IsBase64String(string base64String)
      {
          base64String = base64String.Trim();
          return (base64String.Length % 4 == 0) &amp;&amp;
                 Regex.IsMatch(base64String, @"^[a-zA-Z0-9\+/]*={0,3}$", RegexOptions.None);
      }
      public static string DecryptRijndael(string cipherText, string salt)
      {
          if (string.IsNullOrEmpty(cipherText))
              throw new ArgumentNullException("cipherText");
  
          if (!IsBase64String(cipherText))
              throw new Exception("The cipherText input parameter is not base64 encoded");
  
          string text;
  
          var aesAlg = NewRijndaelManaged(salt);
          var decryptor = aesAlg.CreateDecryptor(aesAlg.Key, aesAlg.IV);
          var cipher = Convert.FromBase64String(cipherText);
  
          using (var msDecrypt = new MemoryStream(cipher))
          {
              using (var csDecrypt = new CryptoStream(msDecrypt, decryptor, CryptoStreamMode.Read))
              {
                  using (var srDecrypt = new StreamReader(csDecrypt))
                  {
                      text = srDecrypt.ReadToEnd();
                  }
              }
          }
          return text;
      }
      private static RijndaelManaged NewRijndaelManaged(string salt)
      {
          if (salt == null) throw new ArgumentNullException("salt");
          var saltBytes = Encoding.ASCII.GetBytes(salt);
          var key = new Rfc2898DeriveBytes(Inputkey, saltBytes);
  
          var aesAlg = new RijndaelManaged();
          aesAlg.Key = key.GetBytes(aesAlg.KeySize / 8);
          aesAlg.IV = key.GetBytes(aesAlg.BlockSize / 8);
  
          return aesAlg;
      }
  }
  </code></pre>
  
  <p>And for the salt, I always pass a new Guid.</p>
  
  <pre><code>var SALT = Guid.NewGuid().toString();
  Security.Encryption.Encryption.Encrypt(DATA, SALT)
  </code></pre>
  
  <p>Thanks!</p>