Re: Error encrypting identity element in web.config

I got this to work by using DPAPI encryption instead of RSA. The command to
use to do the encryption using DPAPI is this:

aspnet_regiis -pef "system.web/identity" "C:\Sites\IntranetSite" -prov
"DataProtectionConfigurationProvider"

See this article for more information:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html/paght000005.asp.

An alternative that also should work is to continue to use RSA but to then
grant access to the key container to the user account that ASP.NET is
running under. The command for that should be something like this (although
this is untested):

aspnet_regiis -pa "NetFrameworkConfigurationKey" "TheFullAccountName"

--Rob Roberts

"Rob Roberts" <robrRemoveThis@xxxxxxxxxxxxxxxxxxxxx> wrote in message
news:%23PnkKG7cGHA.4312@xxxxxxxxxxxxxxxxxxxxxxx
Using information that I got from this MSDN article:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html/paght000023.asp, I
added an identity impersonate element to my web.config file that looks
like this:

<identity impersonate="true" username="MyDomain\TestUser"
password="TestPassword" />

This works fine for allowing a SqlMembershipProvider to access to a remote
SQL server, which is why I did this in the first place. But I'm running
into problems when I try to encrypt the identity element. I've used this
command, as specified in the above article:

aspnet_regiis -pef "system.web/identity" "C:\Sites\IntranetSite"

The command prompt says ""Encrypting configuration section...", and then
"Succeeded!" When I look at web.config in VS2005, the element has been
encrypted, but the IDE shows a few warnings in the "Error List" section.
The are:

Warning 1 The 'configProtectionProvider' attribute is not declared.
c:\inetpub\wwwroot\web.config 16 17 http://localhost/

Warning 2 The element cannot contain white space. Content model is empty.
c:\inetpub\wwwroot\web.config 16 78 http://localhost/

Warning 3 The element 'identity' cannot contain child element
'http://www.w3.org/2001/04/xmlenc#:EncryptedData' because the parent
element's content model is empty. c:\inetpub\wwwroot\web.config 17 10
http://localhost/

When I try to access a page in the site, I get a Configuration Error with
this error message:

"Failed to decrypt using provider 'RsaProtectedConfigurationProvider'.
Error message from the provider: The RSA key container could not be
opened."

Does anyone know what the problem is here? (By the way, this is on my
Windows XP development machine, not a real web server. I'm using .NET
2.0.)

Thanks in advance,
--Rob Roberts





.

Relevant Pages

  • Re: Symmetric encryption algorithm with group like properties
    ... >> Solutions that exist today are not as secure as they can be. ... I wouldn't expect more than PGP / GPG type encryption, ... > versions - with the key, protected by RSA encryption under a RSA public key ... > Alice needs a secure decryption mechanism to read her emails, ...
    (sci.crypt)
  • RE: rsa encrtyption
    ... It seems to work for her now and all we did was apply some Sql Server updates. ... My only guess was that the MS dll she used to apply the RSA encryption was ... According to the RSA encryption reference, I've performed some local tests, ... Export the machine-level RSA key container: ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • RE: rsa encrtyption
    ... According to the RSA encryption reference, I've performed some local tests, ... Grant Read Access to the RSA Encryption Key: ... Export the machine-level RSA key container: ... Import the the machine-level RSA key container on the 2nd server: ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Rabin vs. RSA/ElGamal
    ... the speed difference between RSA ... encryption and Rabin encryption probably is irrelevant. ... For RSA or ElGamal you need exponentiation. ...
    (sci.crypt)
  • Re: Rabin vs. RSA/ElGamal
    ... the speed difference between RSA ... encryption and Rabin encryption probably is irrelevant. ... What DOES takes the time is decryption. ... This also doesn't change the fact that Rabin encryption is still a lot ...
    (sci.crypt)