TripleDES Key Management

From: paul reed (prreed@jacksonreed.com)
Date: 01/15/03 

From: "paul reed" <prreed@jacksonreed.com>
Date: Tue, 14 Jan 2003 16:37:22 -0800

I have all my tripleDES stuff working just fine thanks to
help received in this group and others. However, I have a
problem of how/where to manage my keys used to
encrypt/decrypt my uid/pswrd for SQL Server.

First, I am going to be running this .NET application at
an ISP that hosts .NET applications. So, we must us SQL
Server authentication. We also are not allowed to use the
Registry, or do anything with ACLs on any directories...as
well as cannot touch the machine.config file.

So, right now I plan to (...with sage advice to the
contrary) to store my encrypted uid/pwd in the web.config
file. I don't want to use DPAPI to encrypt the entire
connection string because we must use the machine approach
and if the ISP ever "transparently" moved our app to a new
machine, then then a different hash would be created
causing even more grief.

Ok...so this brings me to...where should I put the key and
IV values to decrypt the information? Any ideas given my
situation? One suggestion read somewhere on MSDN was to
just "bury them in the code". This might not be a bad idea
as we are only moving the binaries to the ISP.

Regards,

Paul Reed

Relevant Pages

  • Re: Another N-Tier Question
    ... Check out SQL Server 2005 Express edition. ... Of course you may have to ask your ISP, assuming you use an ISP, when they ... intranet app, i'd be in boots and all on 2005. ... DAL/middle tier. ...
    (microsoft.public.dotnet.languages.vb)
  • Re: Re:Connection
    ... I know you host a web site on your ISP. ... You want to know you'd better host the SQL server on ...
    (microsoft.public.windows.server.sbs)
  • Re: Securing a web DB
    ... >name, uid, password) from an XML file and establish connection to the DB. ... >We are planning to host the site with as ISP. ... >integrated login) for the database. ... >get to know the SQL server password. ...
    (comp.security.misc)
  • Re: Passing SQL data from one server to another
    ... Will your ISP open up post 1433 for inbound traffic on the firewall? ... Replication will work best if you can get around this firewall issue. ... Looking for a SQL Server replication book? ...
    (microsoft.public.sqlserver.replication)
  • Re: Passing SQL data from one server to another
    ... I spoke with my ISP and they "said" they do not block anything. ... So then you are saying I need ports opened up to do replication from SQL ... from one SQl server to another over the internet? ... Otherwise you may have to use web services. ...
    (microsoft.public.sqlserver.replication)
Loading