=== on 8 Oct 2018, 18:14:56 Nicolas Harraudeau wrote:
*Implementation details*:

Note that the example does not list all RSA subclasses. RSA subclasses have additional encryption and decryption methods which are not present in the parent class.


See https://docs.microsoft.com/en-gb/dotnet/standard/security/encrypting-data[.Net documentation].



=== on 6 Nov 2018, 18:57:56 Duncan Pocklington wrote:
\[~nicolas.harraudeau] a couple of questions:

* _MyCrypto2 : System.Security.Cryptography.SymmetricAlgorithm_: _MyCrypto2_ will have to provide implementations of _CreateEncryptor_ and _CreateDecryptor_, and any use of those methods will be flagged as issues. What's the reason for also flagging class definitions that inherit from _SymmetricAlgorithms_? Is it because implementing your own encrypting algorithms isn't generally a good idea? If so, it would be worth adding that as a comment in the Sensitive Code Example.
* same for _AsymmetricAlgorithm_, except in this case the answer might be different since the base class doesn't define any methods that we are tracking

=== on 7 Nov 2018, 09:57:32 Nicolas Harraudeau wrote:
\[~duncan.pocklington] As said IRL: for both classes it is generally a bad practice to define your own implementations. I'll update the RSPEC right away.

include::../comments-and-links.adoc[]
