title: Disassembling C#
body: <p>I've got a question regarding C#.</p>
  
  <p>I am currently working on a medical software product, and one of the important things is to make sure that the patient's data is encrypted.  I got two questions regarding this:</p>
  
  <p>1.) How secure is the Microsoft .NET implementation of AES (Rijndael) from System.Security.Cryptography? Does it have any known security flaws, or am I fine just using the MS implementation? (note, I know the basic background of how these algorithms work, but I am not really that deep into it to get an idea of how it works).</p>
  
  <p>2.) Since the data is stored on the same PC as the application, how hard is it to get information from a C# application? Assuming I have somewhere in the code</p>
  
  <pre><code>string encrypPassword = "ThisIsMyPassword";
  string encryptedString = EncryptString(ClearString, encrypPassword);
  // save encryptedString to harddrive
  </code></pre>
  
  <p>I know that an attacker could just go down to the assemble code, and at that point there is nothing at all I can do against this (the system has to be able to encrypt / decrypt the data), but is there like a shortcut for C# to get the encrypPassword, since it is managed, or does something like this still require you to go down to the assemble code?</p>