title: AES 256 bit encryption with Rfc2898DeriveBytes
body: <p>I've run into a confusing use of AES with Rfc2898DeriveBytes.  Here's the code that I've found....</p>
  
  <pre><code>public static string Decrypt(string encryptionKey, string cipherValue)
      {
          byte[] cipherBytes = Convert.FromBase64String(cipherValue);
          using (var encryptor = Aes.Create())
          {
              var pdb = new Rfc2898DeriveBytes(encryptionKey, new byte[] { (13 element byte array) });
              if (encryptor != null)
              {
                  encryptor.Key = pdb.GetBytes(32);
                  encryptor.IV = pdb.GetBytes(16);
                  using (var ms = new MemoryStream())
                  {
                      using (var cs = new CryptoStream(ms, encryptor.CreateDecryptor(), CryptoStreamMode.Write))
                      {
                          cs.Write(cipherBytes, 0, cipherBytes.Length);
                          cs.Close();
                      }
                      cipherValue = Encoding.Unicode.GetString(ms.ToArray());
                  }
              }
          }
          return cipherValue;
      }
  </code></pre>
  
  <p>So, "cipherValue" is an encrypted string...as well as "encryptionKey".  The other examples of how to use AES and Rfc2898Derive bytes don't seem to fit this code.  The other examples I've seen have something very plain-text in place of the "encryptionKey" parameter up above, but those examples are usually demonstrating encryption rather than decryption.</p>
  
  <p>This code is being used to decrypt a password in the config file of my application.  The encryption has already been done and I have no resources available to me to tell me how it was accomplished.  I'm assuming that the password was encrypted using the indicated "encryptionKey" and the salt value, along with the default 1000 iterations and the max size Key and IV.</p>
  
  <p>I'm curious mostly about how the "encryptionKey" parameter figures into things.  The "cipherValue" is what's being decrypted and is giving me the right output.  What methodology was at work here, and what advantages, if any, does this have over the other examples I've seen?</p>
  
  <p>Encryption and security aren't my strong suits yet...let me know if I've left out anything important that might shed more light on this.  Thanks in advance!</p>