Programming Windows Store Apps with C#

Appendix A. Cryptography and Hashing

In this appendix we’ll talk about SSL (Secure Sockets Layer), device security, and encryption in SQLite, and then look at practical examples of hashing, generating random data, and symmetric encryption.

SSL

I will touch on SSL first. It goes without saying that all communication with your server/servers should be done over SSL. There’s no excuse for this not to be the case.

Device Security

In a business context, what project sponsors are really worried about are devices getting lost with sensitive information on them. The way to square the circle is to rely on the device to be secure and for your apps to rely on that security. Baking your own security into the app may not actually get you very far, which is one of the reasons why this topic isn’t a central thrust of this book despite its importance in the problem domain. You shouldn’t need to think about it, or do anything special in order to make it happen.

Mobile devices are supposed to be managed via something called mobile device management (MDM). MDM is provided in two parts. One part is provided by the platform vendor and describes “policies” on the device that support device management and security. For example, the platform vendor may bake in a policy that can be turned on or off that indicates whether the user has a passcode on the device, another that specifies whether the device is wiped after n incorrect passcodes, and so on. The second part of MDM is a management tool that pushes down ...