Encryption for API Security in .NET

APIs allow apps to communicate and share data. To ensure this data is safe, we use encryption to convert sensitive information into a secure format. This blog explains encryption and how to implement it in your .NET applications with examples.

What is Encryption?

Encryption is like putting your data in a locked box. Only someone with the correct key can open it. Even if a hacker intercepts your data, they can’t read it without the key.

For example:

• Plain text: Hello
• Encrypted text: HU67*&GHksf@

Why Use Encryption for APIs?

APIs handle sensitive data like passwords, payment details, and personal information. Without encryption:

• Hackers can steal the data.
• Attackers can modify the data.
• Unauthorized users can access your API.

With encryption, your data remains secure, even during transmission.\

Types of Encryption

Here are the two main types of encryption:

1. Symmetric Encryption

• Uses one key for both encrypting and decrypting data.
• Faster but risky if the key is exposed.
• Example: AES (Advanced Encryption Standard).

2. Asymmetric Encryption

• Uses a public key to encrypt and a private key to decrypt.
• More secure since only the private key owner can decrypt the data.
• Example: RSA (Rivest–Shamir–Adleman).

Symmetric Encryption in .NET

Symmetric encryption is great for securing data quickly. Below is an example using AES encryption.

using System;
using System.Security.Cryptography;
using System.Text;

class Program
{
    public static void Main()
    {
        string key = "mysupersecretkey"; // Should be 32 characters for AES
        string data = "Hello, World!";

        // Encrypt data
        string encryptedData = EncryptData(data, key);
        Console.WriteLine($"Encrypted: {encryptedData}");

        // Decrypt data
        string decryptedData = DecryptData(encryptedData, key);
        Console.WriteLine($"Decrypted: {decryptedData}");
    }

    public static string EncryptData(string data, string key)
    {
        using var aes = Aes.Create();
        aes.Key = Encoding.UTF8.GetBytes(key.PadRight(32));
        aes.GenerateIV();

        using var encryptor = aes.CreateEncryptor(aes.Key, aes.IV);
        byte[] dataBytes = Encoding.UTF8.GetBytes(data);
        byte[] encryptedBytes = encryptor.TransformFinalBlock(dataBytes, 0, dataBytes.Length);

        // Combine IV and encrypted data
        return Convert.ToBase64String(aes.IV) + ":" + Convert.ToBase64String(encryptedBytes);
    }

    public static string DecryptData(string encryptedData, string key)
    {
        var parts = encryptedData.Split(':');
        byte[] iv = Convert.FromBase64String(parts[0]);
        byte[] encryptedBytes = Convert.FromBase64String(parts[1]);

        using var aes = Aes.Create();
        aes.Key = Encoding.UTF8.GetBytes(key.PadRight(32));
        aes.IV = iv;

        using var decryptor = aes.CreateDecryptor(aes.Key, aes.IV);
        byte[] decryptedBytes = decryptor.TransformFinalBlock(encryptedBytes, 0, encryptedBytes.Length);
        return Encoding.UTF8.GetString(decryptedBytes);
    }
}

Output:

Encrypted: <encrypted text>
Decrypted: Hello, World!

Asymmetric Encryption in .NET

Asymmetric encryption is safer for sharing sensitive data, as it uses a public-private key pair.

using System;
using System.Security.Cryptography;
using System.Text;

class Program
{
    public static void Main()
    {
        string data = "Hello, Secure World!";
        using var rsa = RSA.Create();

        // Export public and private keys
        var publicKey = rsa.ExportRSAPublicKey();
        var privateKey = rsa.ExportRSAPrivateKey();

        // Encrypt data
        byte[] encryptedData = EncryptData(data, publicKey);
        Console.WriteLine($"Encrypted: {Convert.ToBase64String(encryptedData)}");

        // Decrypt data
        string decryptedData = DecryptData(encryptedData, privateKey);
        Console.WriteLine($"Decrypted: {decryptedData}");
    }

    public static byte[] EncryptData(string data, byte[] publicKey)
    {
        using var rsa = RSA.Create();
        rsa.ImportRSAPublicKey(publicKey, out _);
        return rsa.Encrypt(Encoding.UTF8.GetBytes(data), RSAEncryptionPadding.OaepSHA256);
    }

    public static string DecryptData(byte[] encryptedData, byte[] privateKey)
    {
        using var rsa = RSA.Create();
        rsa.ImportRSAPrivateKey(privateKey, out _);
        byte[] decryptedBytes = rsa.Decrypt(encryptedData, RSAEncryptionPadding.OaepSHA256);
        return Encoding.UTF8.GetString(decryptedBytes);
    }
}

Output:

Encrypted: <encrypted text>
Decrypted: Hello, Secure World!

Real-World Use Case: Securing API Tokens

When APIs exchange tokens like JWTs, encrypting them ensures no one can tamper with or steal them.

string jwtToken = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...";  
string key = "supersecurekeyforapi";  

// Encrypt the token
string encryptedToken = EncryptData(jwtToken, key);  

// Decrypt the token
string decryptedToken = DecryptData(encryptedToken, key);  

Console.WriteLine($"Encrypted Token: {encryptedToken}");  
Console.WriteLine($"Decrypted Token: {decryptedToken}");

Tips for Securing APIs with Encryption

1. Use HTTPS: Always use HTTPS to encrypt data in transit.
2. Avoid hardcoding keys: Use services like Azure Key Vault or AWS KMS for managing keys.
3. Rotate keys: Update your keys periodically to strengthen security.
4. Validate input: Ensure data is from trusted sources before decrypting it.

Final Thoughts

Encryption is the backbone of secure APIs. By encrypting sensitive data and following best practices, you can protect your API and its users from hackers. Use the examples above to start implementing encryption in your .NET applications today.