Answer Posted / ananth

Taking a clue, Microsoft has provided the capability to
encrypt sensitive information in configuration files
including connection strings in ASP.NET 2.0. With this new
capability you can easily encrypt sections of configuration
files which makes your application secure.

This new capability brings it with performance overhead that
occurs when you encrypt or decrypt sections of web.config
files. So use it sparingly. That means be judgmental and
judicious when you decide to encrypt data.

ASP.NET 2.0 introduced Protected Configuration model that
allows you to encrypt data using two Protected Configuration
Providers. They are:

*

RSAProtectedConfigurationProvider: This is the default
provider and uses the RSA Public Key Encryption algorithm to
encrypt and decrypt data.
*

DataProtectionConfigurationProvider: This provider
uses Windows Data Protection Application Programming
Interface (DPAPI) to encrypt and decrypt data.

Let's explore this new capability of encrypting and
decrypting of connection strings in web.config files using
above two providers available in ASP.NET 2.0.
Programmatic Encryption/Decryption

Take web.config file which contains valid connection string
from some existing project. Bellow is an example of
configuration section.

<configuration>
<appSettings/>
<connectionStrings>
<add name="NorthwindConnectionString"
connectionString="Data Source=ARAS02-XP;Initial
Catalog=Northwind;User ID=sa"
providerName="System.Data.SqlClient" />
</connectionStrings>
<system.web>
<compilation debug="true"/>
<authentication mode="Windows"/>
<pages theme="Theme1" />
</system.web>
</configuration>

You can observe <connectionStrings> section in above sample
which contains connection string information.

Add new form to your existing project and add the below
method EncryptConnString() to code behind of the form. We
will use RSAProtectedConfigurationProvider model to encrypt
the connection strings. We will try to analyze this magic
piece of code. Let's start with namespaces. The
System.configuration namespace contains classes which deal
with the configuration information associated with client
applications and ASP.NET applications. The
System.Web.Configuration.WebConfigurationManager class is
the preferred way to provide programmatic access to
configuration files of ASP.NET web applications. You can use
one of open methods provided by WebConfigurationManager that
return configuration object which in turn provides the
required methods and properties to handle the underlying
configuration files. The GetSection method of configuration
object returns the connectionStrings section object for the
web.config file.

using System.Web.Configuration;
using System.Web.Security;
using System.Configuration;

public void EncryptConnString()
{

Configuration config =
WebConfigurationManager.OpenWebConfiguration(Request.ApplicationPath);
ConfigurationSection section =
config.GetSection("connectionStrings");
if (!section.SectionInformation.IsProtected)
{

section.SectionInformation.ProtectSection("RsaProtectedConfigurationProvider");
config.Save();
}
}

Encrypting Connection string using
RSAProtectedConfigurationProvider model

You can observe in below listing that connectionStrings
section is encrypted when we execute above method using
RsaProctectedConfigurationProvider model.

<connectionStrings
configProtectionProvider="RsaProtectedConfigurationProvider">
<EncryptedData Type="http://www.w3.org/2001/04/xmlenc#Element"
xmlns="http://www.w3.org/2001/04/xmlenc#">
<EncryptionMethod
Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" />
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
<EncryptedKey xmlns="http://www.w3.org/2001/04/xmlenc#">
<EncryptionMethod
Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5" />
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
<KeyName>Rsa Key</KeyName>
</KeyInfo>
<CipherData>
<CipherValue>
NQPKYTuUVO5SWpxXdBUpoMKYYUmEBBuAw8LXe+DxMYrkMzzAJsUVw6uZZLJXWa9ipAEx
hvS2hhkGx7MHkpustn+IT+PpuxtIKSDFkumZdA/3kcaHuSO74M75Qt+BmW42v/KWNwVv
7umXLz78ka4jDeY/yf2BMpkcs35TkSS9PVM=</CipherValue>
</CipherData>
</EncryptedKey>
</KeyInfo>
<CipherData>
<CipherValue>
MVKe6xdu6h4DqGHmzuzeBqaWcL+m+Rl0EHi9uwQAqhZ9N56HzGgC66cXEiDJ8IGaSCrAYm
7z2ERQYKwjMyTJMkiJ3cSk7CSgqxfrT3+7+DzzKMkB489AmADfxtRyt3JE0bWIclhsHgLn
YthS6mMiXTusSzRIcPMESb+ZAIkyCTPt6+2BxDNimgFX42Xt7abvNinknaUk
uJYKr7tgOzVfS00IesVA/jou1t8FTjM14b9YGvHPtBDq00Jm/cD9iGtP2OM6RnhLgy+MUr
3NPiuWutsEcUGELfOwkMvKQ6Igsg6eqae4c0dZlg==</CipherValue>
</CipherData>
</EncryptedData>
</connectionStrings>

Similarly, we can encrypt connectionStrings information
using DataProtectionConfigurationProvider model. Use the
same above method and replace parameter for ProtectSection
method with DataProtectionConfigurationProvider as shown below.

section.SectionInformation.ProtectSection("RsaProtectedConfigurationProvider");

<configuration>
<appSettings/>
<connectionStrings
configProtectionProvider="DataProtectionConfigurationProvider">
<EncryptedData>
<CipherData>
<CipherValue>
AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAcHu0TgBbIEyfG1RWWqIDSgQAAAACAAAAAAADZg
AAqAAAABAAAACSAX+UlFBbL2xUT1mYruSgAAAAAASAAACgAAAAEAAAAODHdp8b3SFHl8S6
yVQ/Ydu4AQAAitMpkAI8SjZc349E63yEAV/mVQzOv29H2mXvz2j+2kg8FTGYV95xySZrUH
ICx/i5hBq//iQNc1v/Jp0xLxJf6+K/nSQwJTnGWBn3555HJHKU8yAeQCN9Iw/6YWs/q6oV
GpPwMmoSe6jS+5bHzThxQrpUqxVXB4aHKeVnAfjcdj5bIBKe9jaZ0kP31UVlB9TB5z+94G
a6LNWuWWcZf/iAfrZ/EZMkEcGJE20Reb3XSm/e+LN1di2YyRxXVYV+b6MDTi7DgHC7ilZs
g+/81jCn2UtW4k74wKDXrTjAS3LgWxBdFEUPnwSKbKF+/DF24MVECZ6t7oyxoPH7OqaxR/
IDnPLxHAqtd8eT9VKmzouULpQBwrO6echS1MJL8zmvCNMsLz1JnyBlwxYvst8tQs+5MCIn
dQ1K9615hLiwP/JIUy9T3Hk1pCn37m8tEV+meRguS1yIOXMQ3nsPUI5d1C+Nt4068EecEk
uoWujCEUHu9JcpZa2KVsnSYLix5MOEvqGPtbSMmTt7TE7leicEpEn6Hm3LWYQE2N85Skpt
x5AN/Pfuwl42fMzzs07ZhRFtLDwku/a2/ZQahHIUAAAAdOITPi1vY6agWisqaA6+H/qOoc
s=</CipherValue>
</CipherData>
</EncryptedData>
</connectionStrings>
<system.web>
<compilation debug="true"/>
<authentication mode="Windows"/>
<pages theme="Theme1" />
</system.web>
</configuration>

Encrypted Connection String using
DataProtectionConfigurationProvider

You can in the similar way decrypt connection strings
information using below method.

public void DecryptConnString()
{
Configuration config =
WebConfigurationManager.OpenWebConfiguration(Request.ApplicationPath);
ConfigurationSection section =
config.GetSection("connectionStrings");
if (section.SectionInformation.IsProtected)
{
section.SectionInformation.UnprotectSection();
config.Save();
}
}

Remember, we cannot encrypt all sections of web.config file
using this above programmatic approach. There are few
sections which need some additional steps before we can
encrypt them with above approach.

*

<processModel>
*

<runtime>
*

<mscorlib>
*

<startup>
*

<system.runtime.remoting>
*

<configProtectedData>
*

<satelliteassemblies>
*

<cryptographySettings>
*

<cryptoNameMapping>
*

<cryptoClasses>

In order to encrypt these configuration sections you must
encrypt the value and store it in the registry. There's an
aspnet_setreg.exe command-line tool to help along with this
process.

Explain Authentication mechanism in dotnet

633

---

Define viewstate in .net?

546

---

Where sessions are stored?

659

---

How can we update records in gridview?Is there any appropriate code for it?

1608

---

How many web.config files can I have in an application?

548

---

---

Write a code for sending an email from asp.net application.

540

---

How do I use a proxy server when invoking a web service?

530

---

Is asp.net and .net same?

548

---

Which type of state management is provided by Query String in ASP.NET?

559

---

How do you sign out from forms authentication?

559

---

What are the merits and demerits of viewstate?

582

---

Distinguish between Server-side and Client-side code?

556

---

I want to connect a system in LAN and I want to access that. Whenever I am moving a mouse in my desktop, the similar thing has to happen in another system in which I have connected. I need coding for this in C# and ASP.NET Can anyone please help me. It is very urgent. Thanks in advance. My email id is manojkumarchallagundla@gmail.com Will you please?

1464

---

What is different in .net 1.1 and .net 2.0?

578

---

How many types of state management are there in asp net?

524

---