Re: DPAPI in a Load Balanced Environment

From: Aaron Margosis [MS] (aaron.margosis.ms_at_online.microsoft.com)
Date: 02/27/04 

Date: Fri, 27 Feb 2004 02:24:25 -0500

Each server will have its own machine key for encrypting/decrypting data
using DPAPI. Data that is DPAPI-encrypted on one machine cannot be
decrypted on another machine.

>From Improving Web Application Security: Threats and Countermeaures
http://msdn.microsoft.com/library/en-us/secmod/html/secmod92.asp

Web Farm Considerations...
DPAPI
To encrypt data, developers sometimes use DPAPI. If you use DPAPI with the
machine key to store secrets, the encrypted string is specific to a given
computer and you cannot copy the encrypted data across computers in a Web
farm or cluster.
If you use DPAPI with a user key, you can decrypt the data on any computer
with a roaming user profile. However, this is not recommended because the
data can be decrypted by any machine on the network that can execute code
using the account which encrypted the data.
DPAPI is ideally suited to storing configuration secrets, for example,
database connection strings, that live on the Web server. Other encryption
techniques should be used when the encrypted data is stored on a remote
server, for example, in a database. For more information about storing
encrypted data in the database, see the module, "Building Secure Data
Access."

"Ron Ifferte" <rifferte@mac.com> wrote in message
news:51d3cb7.0402261315.4f50b45c@posting.google.com...
> Has anyone used the DPAPI to store database encryption keys and other
> data in a load balanced environment? Would multiple web servers be
> able to decrypt data if they were originally encrypted by another web
> server?
>
> My app works fine on a single box - but I am concerned about putting
> this into a load balanced production environment.
>
> What do I have to do to get this to work?

Relevant Pages

  • Re: encrypt data
    ... decrypt when needed on client side script? ... I need certain data to be encrypted when I retrieve from the server. ... i then need that encrypted data in my client side code to do cerain things. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Encrypting File System
    ... The question is now - presumably Microsoft would allow encrypted data to be ... decrypted by someone without the relevant key? ... Microsoft MVP ... The Help seems to say that, in order to decrypt ...
    (microsoft.public.windowsxp.security_admin)
  • Re: web.config - encrypting details ASP .NET 1.1
    ... why not use plain DPAPI with the machine key - an attacker would have to run code on the server to decrypt the data. ... From the research I have done, a possible solution is to use DPAPI ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Cracking encrypted data?
    ... are equal to common words like name, email, etc. ... I am using blowfish to encrpyt my client data on the server. ... code and quickly tell which parts of the encrypted data correspond to ... Tees Close, Witham, Essex. ...
    (comp.lang.php)
  • Re: Help with Encryption Library
    ... The minimum text lengh for decryption depends on the algorithm block size ... encrypted data size is less then 8 bytes, ... Secure ASP.NET Applications: Authentication, Authorization, and Secure ... decStream.FlushFinalBlockwhenever the text to Decrypt was under 7 ...
    (microsoft.public.dotnet.framework.aspnet.security)