Added link in AesManaged to article warning of timing vulnerabilities…

[samrueby]

… with CBC-mode symmetric decryption using padding.

Summary

Added a link to an important article from Microsoft about the latest recommendations for securely handling encrypted data while using CBC mode, which is the default for this class.

[mairaw]

Thanks for your contribution @samrueby. @bartonjs can you please take a look? I can make the suggestions from a content perspective after the tech review is done.

[bartonjs]

Seems fine to me.

[mairaw]

Thanks @samrueby. Just have a small edit request before merging this.

[mairaw]

It would probably be good to add this info to the Mode property remarks as well.

[samrueby]

Possibly- but according to the article a lot of other types are apparently affected too:

Aes
AesCng
AesCryptoServiceProvider
AesManaged
DES
DESCryptoServiceProvider
RC2
RC2CryptoServiceProvider
Rijndael
RijndaelManaged
TripleDES
TripleDESCng
TripleDESCryptoServiceProvider

Should all of them be updated?

[mairaw]

@bartonjs can you comment on that?

[bartonjs]

Yes, all of those named types are similarly affected (by having CBC+PKCS7 be the default and CBC with any removable padding being what has the vulnerabilty).

[tdykstra]

@samrueby Do you want to update all of the other types you listed, or should we merge this PR and create an issue to track the work of updating the others?

[BillWagner]

@tdykstra

At this point, I think we should merge this, and create a new issue for the remaining changes. Do you agree?

Tom and I are picking up these PRs