This question is obsolete. Starting with SDK 1.5 packages are no longer encrypted.
Turns out Azure role service packages are encrypted so that once a package is produced only Azure runtime can decrypt it.
Good, but as Bruce Schneier says,
There are two kinds of cryptography in this world: cryptography that will stop your kid sister from reading your files, and cryptography that will stop major governments from reading your files.
and I couldn’t find any description on what cryptography is used in the scenario above – only brief statements that “it is there” which isn’t very convincing.
How good and reliable is the cryptography used for encrypting the service packages?
Look in your %Program Files%\Windows Azure SDK\v1.4 directory and you will find the EncryptKey.cer. The package is encrypted using this public key (assymetric). Only the fabric controller has the private key and can decrypt. It’s just standard RSA.