Encryption of Connection String

From: paul reed (prreed@jacksonreed.com)
Date: 12/29/02 

From: "paul reed" <prreed@jacksonreed.com>
Date: Sun, 29 Dec 2002 10:08:04 -0800

I currently keep my connection string in web.config as clear text. Prior to
going to production I want to encrypt this string (or just the password) and
then after retrieving
it at app startup I want to decrypt it.

I don't want to use the registry to store the encryption key or the
encrypted string...there are many suggestions out there but all point to the
evils of having to store the encrypt key somewhere (so you can decrypt the
connection string at a latter time). One thread I found say to create a
one-way hash...but of course no sample code along with that suggestion.

Can anyone point me in the right direction. I have checked all the sample
MSDN applications (Duwamish, etc...) and they all say, "...now in a real
application, you should encrypt either the whole connection string or at
least the password"...so they offer no code to do this.

What is the best approach?

Thanks in advance.

Relevant Pages

  • Re: Encryption of Connection String
    ... Do you know what level of encryption IS applied to the connection string? ... > to the SQL Server via SQL authentication the password is only ... Thus you might have made all this effort to encrypt the ... > Authentication is always the preferred option unless you are using ...
    (microsoft.public.sqlserver.security)
  • ConnectionString encryption decryption
    ... Decrypt function used to encrypt and decrypt the connection string pass to ... at System.EnterpriseServices.Thunk.Proxy.CoCreateObject(Type serverType, ...
    (microsoft.public.dotnet.general)
  • Re: Help Encrypting Connection String
    ... but I have to do it on SQL Server instead of SQL ... If I'm retrieving the connection string in my own code, ... > in 2.0 you can encrypt nearly all config section out of the box using the ... >> the config file, but .NET 2.0 has more options. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: connectionstring & web farm
    ... You can encrypt separately on each machine, but you will have to encrypt ... "hard coded" unless you put source on the web server. ... Registry is an option that is more secure than config, ... web applications which all are using the same connection string. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Encrypting Connection String
    ... > This article will tell you about several possibilitys to store connection ... >> I currently keep my connection string in web.config as clear text. ... >> evils of having to store the encrypt key somewhere (so you can decrypt ... >> one-way hash...but of course no sample code along with that suggestion. ...
    (microsoft.public.dotnet.framework.aspnet.security)