Question

I’m writing a .Net WinForms application and I need to save a password to access a remote service. I have an XML file that I write all the settings to. However, I don’t want to write the password in plain text into the XML configuration file. I thought about using AesCryptoServiceProvider to encrypt the information. This class requires a key to encrypt the data, which I assume I could just leave in the source code of my program. However, this seems to me to only be marginally better than storing it in plaintext, because the key would always be the same, for all instances of my program. I could generate a key upon first starting the program, but then, where would be a good place to store that? One thought that I had is to use a constant key, and a salt that I store along with the password. This would make a unique “key” for each persons machine, without having to store the key out in the open. Is there a standard way of going about storing this type of information on the user’s hard drive?

Answer 1

i can’t think of a perfect solution for this, but you could use DPAPI …

this will usually prevent decryption of the file on another system, but will not ultimatively protect the data, since the user can extract additional key bytes from your program, and since he has access to the machine / user key that won’t be a problem either …

if your question is more like “where to store that one final crypto key that can not be avoided?” … i’d suggest a registry path for each user with strict access permissions