Re: DPAPI or not DPAPI, that is the question

From: Andrew Edward (spam_at_spam.spam)
Date: 10/29/03 

Date: Wed, 29 Oct 2003 14:22:14 -0500

Of course, right after I posted my article I realized this is probably what
I should do:

Don't use DPAPI to encrypt the data itself. Use DPAPI to encrypt a password
entered by the user, from which we generate our own encryption key. That
way all the user has to do to decrypt the data on another computer is
remember their password. No need to muck around with trying to export and
import DPAPI key(s) (assuming that's even possible).

Sorry...I'm new at this (as if you couldn't tell).

Relevant Pages

  • DPAPI implemented in Crypt32.dll
    ... This works great on windows xp. ... me to debug right up to the point where the DPAPI method ... Encrypt / Decrypt is called from my Visual Basic 6 code. ...
    (microsoft.public.win2000.security)
  • Re: Encryption Key Question
    ... Here's a very quick explanation of how DPAPI works in Windows. ... > used to encrypt the user's secrets. ... the master key can not be decrypted. ... > that there are no universal solutions in security. ...
    (Security-Basics)
  • Re: DPAPI implemented in Crypt32.dll
    ... The DPAPI API for encrypting data is CryptProtectData. ... > Encrypt / Decrypt is called from my Visual Basic 6 code. ...
    (microsoft.public.win2000.security)
  • Re: Size of Entropy with Dpapi Encrypted Connection String
    ... > I am doing TWO things with the dpapi. ... and the symmetric key is used to encrypt and decrypt info in a ... > that was the same number of bytes as the symmetric aes binary key, ... > decrypt some arbitrary text, ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Web.config or App.config Security
    ... I would be surprised if you could use Data Protection Provider from a Web ... If I understand it correctly, it uses DPAPI, but DPAPI (with ... .config file. ... > encrypt all my configurations files. ...
    (microsoft.public.dotnet.security)