Cryptography.

[Bala Nagarajan]

Hello,
I am using .NET's cryptography classes(Symmetric algorithm) to
encrypt/decrypt strings and streams. I want to know the place i should store
the Key and the IV values for the algorithms?Since these values are
sensitive information i definitely cannot store them in the code or config
files. Please elucidate me on this.

Thanks

 

[Brock Allen]

Yeah, key management is a big problem. The way many of the built-in keys
are managed for ASP.NET is to encrypt them per-machine with yet another key
and let that key be managed by the LSA. This sounds odd, but I think it's
the best thing we have. So, look into the DPAPI (DataProtected API) in Win32.
I think Dominick has a managed wrapper for v1.x and IIRC there's a managed
wrapper built into v2.0.

 

[Brock Allen]

Oops, should read "Data Protection" API.

 

[[MSFT]]

Hello,

You may take a look at this article:

http://msdn.microsoft.com/msdnmag/issues/03/11/ProtectYourData/default.aspx

It talks about how to store sensitive informtation like connection string
and keys.

Hope this help,

Luke

 

[Paul Glavich [MVP ASP.NET]]

Brock is correct. I have a managed wrapper for V1.x here
(http://www.theglavs.com/glavtech/Downloads/DPAPI_Wrapper.zip)
FYI, in V2.0, look into the ProtectedData and ProtectedMemory classes for
equivalent DPAPI functionality built into the framework.

 

[Bala Nagarajan]

Thanks a lot guys for helping me out.
My situation is as follows.

My application will require users to logon to the system by supplying their
windows credentials.Since i will have a loaded user profile can i use
DPAPI user specific key to encrypt and decrypt data?Is this a correct
approach?

I want to actually encrypt the whole configuration file during set up. I
intend to encrypt the configuration file and save the encrypted contents to
a different file and delete config file during the set up. Is this a good
appproach? If so how can perform this step (namely file delete and save)
during my set up process?


Thanks

-Bala

 

[[MSFT]]

Hello,

Why do you need to encrypt the whole config file? An asp.net app couldn't
live without a config file and it still was exposed to installation user
after setup.

Luke

 

[Bala Nagarajan]

I am sorry for not saying this first. My application is an windows
application.So my application can live without the config file. Will my
approach make sense now?

Thanks

 

[[MSFT]]

That will be fine. I think your approach is right on the track.

Luke