Storing a cryto key in .Net

[Morten Brun]

Hi

I am looking for some good suggestions to store a cryto key with my
new Asp.Net application using Triple Des to encrypt data. The database
is on SQL2000 server..

My first idea was to store the key within the program, but as programs
can be easily obfuscated this is probably a bad idea.

Any suggestion will be highly appreciated.

Morten

 

[Ram Sunkara [msft]]

Use DPAPI.



Make a command line executable that writes a DPAPI blob into your
application configuration file. Let your application decrypt the DPAPI blob
as when required to encrypt or decrypt.



Deploying your application will now include running this executable in all
the target machines.



Put this command line executable in share and give execute only permissions
to all the authorized users, explicitly deny coping this executable.



Ram-

 

[Morten Brun]

Hi Ram

Thanks your suggestion, which unfortunately does not fit my purpose,
however have found some good MSDN articles on DAPI so there might be a
solution in this.

Morten

 

[Alek Davis]

Morten,

Maybe this article can give you some suggestions:

http://msdn.microsoft.com/msdnmag/issues/03/11/ProtectYourData/default.aspx

Alek