Re: Help Encrypting Connection String

hi,

the "best" way is to use DPAPI - because you don't have to do your own key management. There are a lot of wrappers out there, e.g.

http://www.leastprivilege.com/DPAPITools.aspx

the tool you are referring to is called aspnet_setreg - it uses DPAPI to encrypt the section and places it into web.config - the config file then refers to the reg key.

in 2.0 you can encrypt nearly all config section out of the box using the ProtectedConfiguration provider - there you have the choice of using DPAPI or RSA keys.
There are some section that you can't encrypt (basically a chicken/egg problem or section that have to be read before managed code is run) - there again you have to use aspnet_setreg.

My recommendation : use DPAPI (either the wrapped API in 1.1 or protectedconfig in 2.0).

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

Enterprise Library (either the June 2005 release for .NET 1.1 or the
upcoming 2.0 release for .NET 2.0) can "magically" encrypt parts of
your configuration file.  You can also use the Ent Lib cryptography
block to encrypt and decrypt arbitrary strings, so that will certainly
work for what you want to do.

Ent Lib also has a notion of a data access block that allows you to
configure connection strings with a graphical tool and encrypt the
whole section on the fly if you want.  You can programmatically
retrieve connection strings defined in the configuration if you want.
Essentially, it offers are variety of ways to solve your problem
easily.

With .NET 1.1, you need the aspnet_regiis thing to encrypt parts of
the config file, but .NET 2.0 has more options.  I'm not really up on
them yet though so I can't comment on how all of that new stuff works
yet.

Joe K.

"FlyFishGuy" <FlyFishGuy@xxxxxxxxxxxxx> wrote in message
news:OnpiE8wEGHA.4036@xxxxxxxxxxxxxxxxxxxxxxx

I'm certainly OK with starting basic and becoming more aggressive as
my level of understanding increases. I think I like hardcoding the
key as opposed to putting it directly in web.config. I don't like to
hardcode anything, in general, but I'd rather do that with an
encryption key than the underlying data itself.

Ivan's code is pretty straightforward, but I've had this vision
(based on some of the articles I've seen) that I could simply encrypt
the section in web.config and the framework would decrypt on-the-fly.
Perhaps this is only when using the aspnet_regiis method or perhaps
I'm just confused.

Regarding the Enterprise Library, I've not heard of it before and I'm
all about high level classes and nice GUI's. I keep discovering neat
tools scattered about the place. It looks like 2.0 is not out yet,
but v1.1 is supposed to be compatible. I don't have much of a code
investment in 1.1 but I understand that many best practices have
changed. Should I just wait for 2.0 before diving in?

Thanks Joe

"Joe Kaplan (MVP - ADSI)" <joseph.e.kaplan@xxxxxxxxxxxxxxxxxxxxxxxx>
wrote in message news:%23WsXSlvEGHA.1028@xxxxxxxxxxxxxxxxxxxxxxx

The biggest decision for you here is how you want to store the
encryption key.  If you are ok with keeping the key in plain text in
your web.config file or just hard-coding it in your code, then this
is pretty easy.  That won't ward off determined hackers, but it
should prevent casual snooping.

For samples of simple symmetric encryption going back and forth
between strings (which is probably what you want), I like Ivan's
sample on www.dotnetthis.com.  It is C#, but easy to adapt/convert.

I also like the crypto capabilities in Enterprise Library for doing
this stuff as it makes it very simple to use and has nice config
support for storing the key and a nice GUI for configuring all of
it.

Joe K.

"FlyFishGuy" <FlyFishGuy@xxxxxxxxxxxxx> wrote in message
news:uouuXHvEGHA.2320@xxxxxxxxxxxxxxxxxxxxxxx

I am trying to perform the most basic encryption of my connection
string in web.config and I am totally lost. Before someone flames
me for not researching before posting, let me tell you that I have
read literally dozens of explanations and blogs on this and I am
more confused than ever.

Every article I have read starts out with stating what a breeze
this is to do, but by the time I get to the 3rd paragraph, either
my head is spinning with encryption technicalities or they assume
that I can run aspnet_regiis on the server. I don't host my web
server, like many people, and I find this assumption obnoxious. To
make matters worse, virtually every article I've read has a
different methodology to perform the encryption. I understand that
there are many ways to skin the same cat in .NET, but I'm looking
for simple, if it exists. I never used the 2005 beta, and I'm
guessing that many of these articles are referring to functionality
that has subsequently changed.

I'm not trying to hide anything from the NSA. I simply wish to
prevent
some scumbag from trashing my site.
If I have to spend 40 hours becoming an encryption guru before I
can do
this, then that's fine. I just wish that someone would be up front
about
this and stop stating what a snap it is. If it really is a snap
could
someone please provide me a link to some code that is current,
accurate,
and unassuming. VB is my language, but I'll certainly settle for
some C#
code.
Thanks



.

Relevant Pages

  • Re: Encrypt values for a key in appsettings
    ... Actually i need to encrypt only the password fields and decrypt the ... TripleDESCryptoServiceProvider to encrypt the password. ... Key can be placed in config file. ... You don't have to decrypt the data when using the ProtectSection ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Web.config encryption in shared hosting scenario
    ... Open the config using WebConfigurationManager, get the section using GetSection, and call Protect() on the SectionInformation you get back. ... database via SQL authentication rather than Windows authentication, ... best practice dictates that I encrypt the web.config file ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Save passwords in scripts
    ... I was using a the ConfigParser module to store other info in a config ... characters) and cleared the entries in the config file. ... Rotor module to encrypt the string, UUencoded the result and stored the ... UUencoded result in a special config entry. ...
    (comp.lang.python)
  • Re: Windows App .NET 2.0: Encryption of Connection Strings
    ... no special privileges are needed, besides write access to the config file ... CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt" ... > 3) I guess that I protect all kinds of configuration sections? ... >> Hello Henrik, ...
    (microsoft.public.dotnet.security)
  • Re: Encryption Key Question
    ... Here's a very quick explanation of how DPAPI works in Windows. ... > used to encrypt the user's secrets. ... the master key can not be decrypted. ... > that there are no universal solutions in security. ...
    (Security-Basics)