Question

I am developing Windows Phone 7 application in which I send encrypted data to a webservice that decrypts it. I’m using the protectedData.protect which is only working properly as long as I am encrypting and decrypting from my application (for testing only); once I use the webservice the behaviour changes.

This is the code from the webservice:

If Flag = False Then ' Decrypt
    Dim ProtectedPinByte As Byte() = Encoding.UTF8.GetBytes(password)
    Dim PinByte2 As Byte() = ProtectedData.Unprotect(ProtectedPinByte, Nothing, DataProtectionScope.CurrentUser)
    password = Encoding.UTF8.GetString(PinByte2, 0, PinByte2.Length)
    Return Bll.Utilites.EncryptDecryptStr(True, password) 'Encrypts using another algorithm
Else ' Encrypt
    EncPassword = Bll.Utilites.EncryptDecryptStr(False, password) 'decrypts  from another algorithm
    Dim PinByte As Byte() = Encoding.UTF8.GetBytes(EncPassword)
    Dim ProtectedPinByte As Byte() = ProtectedData.Protect(PinByte, Nothing, DataProtectionScope.CurrentUser)
    Return Encoding.UTF8.GetString(ProtectedPinByte, 0, ProtectedPinByte.Length)
End If

Answer 1

This isn’t possible as the ProtectedData class on Windows Phone uses device credentials to encrypt the data, it can only be decrypted on that device.

In Silverlight for Windows Phone, both the user and machine
credentials are used to encrypt or decrypt data.

http://msdn.microsoft.com/en-us/library/system.security.cryptography.protecteddata(v=vs.96).aspx