Question

Scenario:
I have a WPF desktop application which will be distributed on different machines for different customers.
The application has an XML configuration file ‘ApplicationConfiguration.xml’
This XML file contains connection strings.
I need to encrypt these connection strings as the ApplicationConfiguration.xml file will be copied to the installation folder of the application along with the main application exe.

Planned Strategy :
My planned strategy was to encrypt the ‘ApplicationConfiguration.xml’ file after the installation. ( If I could do it during the installation then all the better )

What I have tried :
Going with the strategy of encrypting the xml file AFTER installation I decided to write a simple winforms application to allow the user to browse for the ‘ApplicationConfiguration.xml’ and simply press a button to encrypt it.
When I did this, I got a new file created in the form of an xml Configuration File.
‘ApplicationConfiguration.xml.Config’, but the original ‘ApplicationConfiguration.xml’ file still remained intact with the connection strings untouched…
Now…. when i copied the contents of this file into my ‘ApplicationConfiguration.xml’ file the program was able to function as normal … the xml is now encrypted remember.
So it appears that the .NET 4.0 framework can DECRYPT the xml file without me having to write anymore code in my WPF application.

See code below to do the encryption:

   protected void EncryptConfig(Boolean bEncrypt)
    {
        string path = SelectedFilePath();

        Configuration config = ConfigurationManager.OpenExeConfiguration(path);

        // Define the Rsa provider name. 

        const string provider = "RsaProtectedConfigurationProvider";

        // Get the section to protect. 

        ConfigurationSection connStrings = config.ConnectionStrings;

        if (connStrings != null)
        {
            if (!connStrings.SectionInformation.IsProtected)
            {
                if (!connStrings.ElementInformation.IsLocked)
                {
                    // Protect the section.             
                    connStrings.SectionInformation.ProtectSection(provider);
                    connStrings.SectionInformation.ForceSave = true;
                    config.Save(ConfigurationSaveMode.Full);
                }
            }
        }

        MessageBox.Show("Config has been encrypted");
}

I have posted example output ( Replacing the CipherData with dummy characters ) which is created by the code above

    <?xml version="1.0" encoding="utf-8"?>
 <configuration>    
<connectionStrings configProtectionProvider="RsaProtectedConfigurationProvider">
    <EncryptedData Type="http://www.w3.org/2001/04/xmlenc#Element"
        xmlns="http://www.w3.org/2001/04/xmlenc#">
        <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" />
        <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
            <EncryptedKey xmlns="http://www.w3.org/2001/04/xmlenc#">
                <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5" />
                <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
                    <KeyName>Rsa Key</KeyName>
                </KeyInfo>
                <CipherData>
                    <CipherValue>skfjshsadfhsadkjfsadhfsadkhfdsafhsadkfhkljdfh=</CipherValue>
                </CipherData>
            </EncryptedKey>
        </KeyInfo>
        <CipherData>
            <CipherValue>adfdsafdsafdsfdsafsadfsadfsadfsdfasfdsadfsafsadfdsf=</CipherValue>
        </CipherData>
    </EncryptedData>
</connectionStrings>

So I have a few questions on what I have done above and what I am trying to do :

1) Can the application read the encrypted connection strings without writing new code in the WPF application ? And if so, will each machine be able to read the encrypted connection strings if I do all the encryption processing on my own machine? As I have read about the ‘Key’ required.. and dont understand where the keyName above ( Rsa Key ) comes from.

2) Why when I save the xml file in my above code example is there a new ‘xml.config’ file created? Should I be manually copying the newly generated code into the original applicationConfiguration.xml file?

Just to add, when I decrypt the new xml.config file using the following code:

       connStrings.SectionInformation.UnprotectSection();
                config.Save(ConfigurationSaveMode.Full);

.. I get the following output ! WHY! 🙂

    <?xml version="1.0" encoding="utf-8"?>
<configuration>
<connectionStrings>
    <clear />
    <add name="LocalSqlServer" connectionString="data source=.\SQLEXPRESS;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|aspnetdb.mdf;User Instance=true"
        providerName="System.Data.SqlClient" />
</connectionStrings>
    </configuration>

I would have expected to get my original 3 connection strings… no?

Basically I am looking for the correct method to proceed with encrypting an xml file of connection strings and allow the application to be deployed and read on different machines.

Any help appreciated.

Answer 1

See .Net Encryption – Dataprotection API is no help here, you would need to send it unencrypted to have it locally encrypted to the machine / user key.

At best you can use any of the available encryption classes to encrypt it to a key stored within your app and hope nobody disassembles your software.