Encrypted configuration file?

Hi.

For the ongoing logger project, I was thinking about having the logger
encrypt & authenticate it's configuration file to prevent someone from
tampering with it, and to make the config file harder to detect (ie.
"text in file" searches will be useless). Would this work?

1. For authentication, upon saving out the config, we attach an MAC
generated with a user-supplied password, which also locks the
configuration program. Whenever the configuration program is started
up, it prompts the user for this password, and if it's right, attempts
to verify the MAC. If it fails, it tells the user the configuration
file has been tampered with. Whenever the user saves the configuration
file, it asks for the password. Even though it's entered in at
configurator startup, the program doesn't keep it in memory in order to
make a memory attack more difficult.

2. For obscurity, we encrypt the config with a key stored in another
file somewhere else on the drive, so the logger can read it's config on
boot without having to prompt the user for the password. This key is
randomized to ensure it's not related to the password in any way (and
thus to prevent someone from forging the MAC if they find the file). Of
course, if this file is compromised, the config can be too, but any
changes would still be detected by the MAC. The encryption is just here
to make finding the config harder.

How good is this system, given the purpose of it?

.

Relevant Pages

  • Re: Help Encrypting Connection String
    ... the tool you are referring to is called aspnet_setreg - it uses DPAPI to encrypt the section and places it into web.config - the config file then refers to the reg key. ... You can also use the Ent Lib cryptography block to encrypt and decrypt arbitrary strings, so that will certainly work for what you want to do. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Encrypt values for a key in appsettings
    ... Actually i need to encrypt only the password fields and decrypt the ... TripleDESCryptoServiceProvider to encrypt the password. ... Key can be placed in config file. ... You don't have to decrypt the data when using the ProtectSection ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Web.config encryption in shared hosting scenario
    ... Open the config using WebConfigurationManager, get the section using GetSection, and call Protect() on the SectionInformation you get back. ... database via SQL authentication rather than Windows authentication, ... best practice dictates that I encrypt the web.config file ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Save passwords in scripts
    ... I was using a the ConfigParser module to store other info in a config ... characters) and cleared the entries in the config file. ... Rotor module to encrypt the string, UUencoded the result and stored the ... UUencoded result in a special config entry. ...
    (comp.lang.python)
  • Re: Windows App .NET 2.0: Encryption of Connection Strings
    ... no special privileges are needed, besides write access to the config file ... CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt" ... > 3) I guess that I protect all kinds of configuration sections? ... >> Hello Henrik, ...
    (microsoft.public.dotnet.security)