2

Is there a simple to use encrypt/decrypt method outside the System.Web.Security namespace that are as easy to use as MachineKey.Protect/MachineKey.Unprotect()?

Or does anyone know if you can set up this outside ASP.Net as my quick trial showed that it seemed to generate a new key or something in between app restarts meaning you couldn't decrypt anything between restarts of the app.

I can roll my own using the appropriate classes, I was just wondering if they'd finally provided a simpler API?

2 Answers 2

3

I was searching for this as well. And after spent a few hours digging around, I found System.Security.Cryptography.ProtectedData. The usage is very similar, just that you need to provide the scope. And here's the best part: it's available from .NET 2.0.

Hope this helps someone someday.

1
  • 3
    This seems like a pretty good solution, however one word of caution to anyone using this - read up on DPAPI first. There are some gotchas, the big one being that this method is highly dependent on the user context under which it runs. It's also pretty tightly coupled with Windows, so there might be the possibility of breaking changes over time.
    – killthrush
    Jul 9, 2014 at 16:33
1

The MachineKey in asp.net is autogenerated every time it starts up. To get around this you can set the MachineKey explicitly.

Of course, if the process is running on the same machine as your potential hacker, it's all a bit pointless.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.