Hi Chuck,
Thank you for posting and glad to see you again.
As for the ASP.NET 2.0 configuration section protection, it provides two
encryption approachs, DPAPI and RSA. I think the current approach you're
using is the DPAPI one which is mentioend in the following article, correct?
#How To: Encrypt Configuration Sections in ASP.NET 2.0 Using DPAPI
http://msdn.microsoft.com/library/en-us/dnpag2/html/PAGHT000005.asp?frame=tr
ue
As for this data protection, it is something like a symmetic data
encryption which use a single shared session key to encrypt and decrypte
the data. Also, this session key is machine specific(or user storespecific)
which make it not portable from machine to machine. So when you're using
this approach(DPAPI) to protect the configuration section, we should do the
final encrypting work on the deploymenet server rather than on the
development server(where you compile the applcation). And normally, the
work (execute the aspnet_regiis tool from commandline to encrypt the
application's configuration sectino) is done by the deployment server's
administrator.
Then, what shall we do if we want to make the encrypting work done at
before the application be deployed to the target deployment server (on
development server)? Well, this brings out the second option------ RSA
data encryption approach. Actually you can also find the above
article(about DPAPI approach mentioned this in the final section , about
protect configuration data in WEBFARM scenario).
The RSA approach is just based on RSA asymmetric data encryption/decryption
which use a public/private key pair. So when we want to make multiple
webservers share the protection key setting(e.g do the encryption on the
web.conifig file on one server, and when deploy it to other servers, also
want the protected data be usable without additional work), we can create a
custom RSA key pair, and on the development server, we still use the
aspnet_regiis tool to encrypt the web.config use the created RSA key pair's
public key, and export the private key(which is necessary for decrpyting
the data) to other servers which will want to decrypt the data(for your
scenario, it's the deployment server). And all the tasks mentioned here
like creating the RSA key pair, encrypte through it, or export it can be
done via the aspnet_regiis tool.
Here is another MSDN article which mentioned using RSA approach to do the
configuration protection (also be referenced in the above article):
#How To: Encrypt Configuration Sections in ASP.NET 2.0 Using RSA
http://msdn.microsoft.com/library/en-us/dnpag2/html/paght000006.asp?frame=tr
ue
Hope this helps you.
Regards,
Steven Cheng
Microsoft Online Community Support
==================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.