Encryption of Connection String

[Ashish Jain]

Environment: .Net Framwework 2.0/SQL Server 2005 - Windows XP SP2/Windows
Server 2003

My web application is a mix of ASP and ASP.Net. My "ASP" web application
uses a serviced COM+ component written in C# 2.0 for authentication. The
confuguration file itself is located in System32 folder as required by COM+.
For reading the config file, we are creating a separate appdomain in the
serviced component (since COM+ component is used by ASP pages).

The connection string is stored in clear text right now and I want to
encrypt it.

My developer environment is Windows XP SP2 and deployment is Windows Server
2003. I want the approach to work on both systems. Also, I want to keep it
easy to copy the installation from one machine to another with minimum
changes (say from QA to deployment).

Can you please guide me on the standard approach for encryption of
connection string?

Thanks and Regards,
Ashish Jain
(e-mail address removed)

 

[Mark Rae]

Environment: .Net Framwework 2.0/SQL Server 2005 - Windows XP SP2/Windows
Server 2003

My web application is a mix of ASP and ASP.Net. My "ASP" web application
uses a serviced COM+ component written in C# 2.0 for authentication. The
confuguration file itself is located in System32 folder as required by
COM+. For reading the config file, we are creating a separate appdomain in
the serviced component (since COM+ component is used by ASP pages).

The connection string is stored in clear text right now and I want to
encrypt it.

My developer environment is Windows XP SP2 and deployment is Windows
Server 2003. I want the approach to work on both systems. Also, I want to
keep it easy to copy the installation from one machine to another with
minimum changes (say from QA to deployment).

Can you please guide me on the standard approach for encryption of
connection string?

There is no "standard approach" per se - take a look at the
System.Cryptography namespace - loads of options for string encryption...
Also, a cursory Google search would have shown you loads of possibilities
too:
http://www.google.co.uk/search?sour...en&q="web.config"+"connection+string"+encrypt

However, you might ask yourself why you should bother doing this in the
first place... Who are you trying to hide the connection string from...? If
your users can see it, then you need to start from the beginning!

If a hacker is clever enough (or your security is poor enough) to get as far
as being able to read your config file, then the fact that its contents may
or may not be encrypted really is the least of your worries...