Encrypt the connection string in Webconfig, using RSA Asymmetric encryption to save the key container with Windows

A simple workaround:

Webconfig decryption, failed to decrypt with provider "RsaProtectedConfigurationProvider". The provider returned an error message: The RSA key container could not be opened.
Issue: Not added to access RSA key container
Command:aspnet_regiis-pa "NetFrameworkConfigurationKey" "NT authority/network SERVICE"
Caveats: XP under: Aspnet_regiis-pa "NetFrameworkConfigurationKey" "ASPNET"
Encryption:aspnet_regiis-pe "appSettings"-app "/Application Name"
Decryption:aspnet_regiis-pd "appSettings"-app "/Application name" such as (/petshop/web)

A more flexible solution:
1. Create a key container
aspnet_regiis-pc "Connectionstringskey"-exp
Connectionstringskey is the name of the key container
You can use aspnet_regiis/? To view the use of this command

2. Add the following to the Web. config

[C-sharp]View Plaincopy print?

2. <configProtectedData>
4. <providers>
6. <clear/>
8. <add name="Connectionstringskeyprovider"
10. Type="System.Configuration.RsaProtectedConfigurationProvider, System.Configuration, version=2.0.0.0,culture= Neutral, publickeytoken=b03f5f7f11d50a3a, Processorarchitecture=msil "
12. Keycontainername="Connectionstringskey"
14. usemachinecontainer="true"/>
16. </providers>
18. </configProtectedData>

3. by command line : Encrypts the specified configuration section of the Web. config file under the specified directory with the specified key
Aspnet_regiis-pef "ConnectionStrings" "D:/testproj/websitetest"-prov "Connectionstringskeyprovider"
For sub-configuration section/delimited representations, such as the identity configuration stanza needs to be written as "system.web/identity"
4. If you access the Web program, the page prompts Error message from the Provider:the RSA key Container could is not opened.
is due to the inability of the Network Service account to access the key file. Locate the key file and give the network service Read permission. The key file is located (can be sorted by time to find the key file that you generated)
vista:c:/programdata/microsoft/crypto/rsa/machinekeys/
XP or other: C:/Documents and Settings/all users/application Data/microsoft/crypto/rsa/machinekeys

Now: To view the encrypted token, the content is already encrypted.

5. through the. aspx page : Encrypted connection string: interface

Background code:

[C-sharp]View Plaincopy print?

2. Encrypt button
4. protected void button1_click (object sender, EventArgs e)
6. {
8. //① the nodes that require encryption:
10. string name = @"connectionStrings";
12. //② current path;
14. string appPath = "/logincontral";
16. Configuration config = webconfigurationmanager.openwebconfiguration (appPath);
18. //③ provides encryption: (using custom encryption in this way)
20. //String Provider = "Rsaprotectconfigurationprovider";
22. string Provider = "Connectionstringskeyprovider";
24. Config. GetSection (name). Sectioninformation.protectsection (provider);
28. //⑤ Saving the Web. config file
30. Try
32. {
34. Config. Save ();
36. }
38. catch (Exception ex)
40. {
42. Response.Write (ex. Message);
44. }
46. if (config. GetSection (name). sectioninformation.isprotected)
48. {
50. button1.enabled = false;
52. Response.Write ("Encryption succeeded!   ");
54. }
56. Else
58. {
60. Response.Write ("Encryption failed!   ");
62. }
64. }
68. Decrypt button:
72. protected void button2_click (object sender, EventArgs e)
74. {
76. //① requires node-dense nodes:
78. string name = @"connectionStrings";
82. //② current path;
84. string appPath = "/logincontral";
86. Configuration config = webconfigurationmanager.openwebconfiguration (appPath);
90. //③ Use the Unprotectsection method to decrypt;
94. Config. GetSection (name). Sectioninformation.unprotectsection ();
98. //④ Saving the Web. config file
100. Config. Save ();
104. if (config. GetSection (name). sectioninformation.isprotected==false)
106. {
108. button2.enabled = false;
110. Response.Write ("decryption succeeds!   ");
112. }
114. Else
116. {
118. Response.Write ("Decryption failed!   ");
120. }
122. }

Note: string appPath = "/logincontral" is the current project path;

Connection string before encryption:

[C-sharp]View Plaincopy print?

1. <connectionStrings>
2. <add name="Connection" connectionstring= "data source=.; Database=aspnetdb;user id=sa;pwd=123; "/>
3. </connectionStrings>

After the encrypted connection string:

[C-sharp]View Plaincopy print?

2. <connectionstrings configprotectionprovider="Connectionstringskeyprovider" >
4. <encrypteddata type="Http://www.w3.org/2001/04/xmlenc#Element"
6. xmlns="http://www.w3.org/2001/04/xmlenc#" >
8. <encryptionmethod algorithm="HTTP://WWW.W3.ORG/2001/04/XMLENC#TRIPLEDES-CBC"/>
10. <keyinfo xmlns="http://www.w3.org/2000/09/xmldsig#" >
12. <encryptedkey xmlns="http://www.w3.org/2001/04/xmlenc#" >
14. <encryptionmethod algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>
16. <keyinfo xmlns="http://www.w3.org/2000/09/xmldsig#" >
18. <keyname>rsa key</keyname>
20. </KeyInfo>
22. <CipherData>
24. <ciphervalue>aepogg4vvhd8k6nvhvmdo8fagfmopoddvnbn5vpv0mxp8ngrimnzfvflrhhvooiu56mcmmr6n5cunixzimgb/ Ztgcnmsiku8sr6ytx8iuh64u9ivujwaoabtzp4ahlhmih6ywkhxjmqrjyys2ecsocquzq0ndkkc3omg/ucoik0=</ciphervalue>
26. </CipherData>
28. </EncryptedKey>
30. </KeyInfo>
32. <CipherData>
34. <ciphervalue>bimah/6vwvi0fkvqijpszzkhk+a6qni0aa794yxi1x+ sffkdtsur15hvcbyolborckprhx94mpom2ekobqyvycf24pdyakiffazo1sluzmutcxfvu/ Ltbqn83bnjdgbgo6evtdg4m7dsavr6qwyep8wysqwwubkwslzsmynqpoyghvb9btvjbscwiuz4ynfhvutzigisjqa=</ciphervalue>
36. </CipherData>
38. </EncryptedData>
40. </connectionStrings>

Other backup operations:
1. Decrypt the Web. config
aspnet_regiis-pdf "connectionStrings" "D:/testproj/websitetest"
2. Export the key container as an XML file
aspnet_regiis-px "Connectionstringskey" "C:/key.xml"。     aspnet_regiis-px "Connectionstringskey" "C:/keys.xml "-pri   This one is exported with the private key, so we'll use this       If you delete and then run the program, you will be prompted with an error: &NBSP;
Span style= "color: #000000;" >    Parser Error message: Failed to decrypt with provider "Lixinkeyprovider". The provider returned an error message: The RSA key container could not be opened.  
    also proves that on any machine that does not have the correct key container Lixinkey installed, The connectionstrings section cannot be decrypted by the program and therefore will not function properly.
      aspnet_regiis-pi "Lixinkey" "C:/keys.xml"

at this point, running the program will find that it can be decrypted again. Prove that the encryption and decryption mechanism is running normally.
Finally, let's talk about how the security guarantees provided by this mechanism can be used:
1. Encrypting the App. config for the WinForm program does not make much sense, because the client can, however, run aspnet_regiis-pdf to decrypt the configuration file, exposing sensitive information.
2. The significance of encrypting Web. config is also limited to that when the Web. config file is accidentally compromised, no sensitive information is disclosed, and if a malicious attacker has obtained permission to run the program on the server, as with App. config, it can be easily passed by running the ASPNET _regiis-pdf gets the clear text.
3. Also, through the Aspnet_regiis-pa "key" "NT authority/network SERVICE" Control access to the key container for different users, you should also be able to further obtain some security, such as can control some users even log on to the server, It is also not possible to decrypt the configuration file with Aspnet_regiis-pdf.

Encrypt the connection string in Webconfig, using RSA Asymmetric encryption to save the key container with Windows