How to store an encrypted connection string in the registry

Encryption | registry | string target
The objectives of this chapter are:

• Store encrypted database connection strings in the registry

• Read and decrypt the encrypted database connection string from the registry.


Back to the top of the page
Applicable scope
This chapter applies to the following products and technologies:

Microsoft Windows XP or Windows Server (Service Pack 3) and later operating systems

Microsoft. NET Framework version 1.0 (Service Pack 2) and later

Microsoft Visual c#®.net


Back to the top of the page
How to use the contents of this chapter
To learn the contents of this chapter:

• You must have the experience of programming with Visual C #. Net.

• You must have the experience of programming with Microsoft Visual studio®.net.

• You must have experience using ASP.net to develop WEB applications.

• Create a regular encryption library as described in how to create a cryptographic library. The functionality provided by this cryptographic library is used in this chapter to encrypt and decrypt the database connection string.

• Read the Security store database connection string in chapter 12th data Access security. This article describes some of the techniques used to securely store database connection strings.


Back to the top of the page
Summary
If developers write applications that require access to the database, they all face the same problem of where the database connection string is securely stored. The registry provides them with a choice. However, although the use of access control lists (ACLs) protects the security of individual registry keys, in order to improve security, you should encrypt the connection string before it is stored.

This chapter describes how to store the encrypted database connection string in the registry and how to retrieve it from an asp.net Web application. It uses the regular cryptographic library that you created in how to create the cryptographic library.

Back to the top of the page
Background knowledge that you must understand
Before you begin to learn this chapter, you should know:

• The connection string, initialization vector, and key used for encryption are stored as named values under the following registry key in the registry.

Hkey_local_machine\software\testapplication


• Initialization vectors and keys must be stored to decrypt the connection string.


Back to the top of the page
Storing encrypted data in the registry
This procedure creates a Windows application to encrypt the sample database string and store the string in the registry.

• Storing encrypted data in the registry

1.
Start visual Studio. NET and create a new Visual C # project named Encryptiontestapp.

2.
Adds a reference to the Encryption.dll assembly.
To create this assembly, you must perform the steps described in creating the cryptographic library in this guide.

3.
Add the following using statement below the existing using statement at the top of the Form1.cs.

Using encryption;
Using System.Text;
Using Microsoft.Win32;


4.
Add the controls in table 1 to the Form1 and arrange them as shown in Figure 1.

Table 1:encryptiontestapp Control

Control text ID
Label
Connection string:


text box

Txtconnectionstring

Label
Key:


text box

Txtkey

Label
Initialize vector:


text box

Txtinitializationvector

Label
Encrypt string


text box

Txtencryptedstring

Label
Decrypting a string


text box

Txtdecryptedstring

Button
Encryption
Btnencrypt

Button
Decrypt
Btndecrypt

Button
Write Registry data
Btnwriteregistrydata



Figure 1
The Encrypt Test Sleeve dialog box

5.
Set the Txtconnectionstring Text property to

"Server=local; Database=pubs; Uid=bob; Pwd=password "


6.
Set the Txtkey Text property to

"0123456789012345"

The key length is 16 bytes to meet the requirements of the triple DES encryption algorithm.

7.
Set the Form1 Text property to

"Encryption test Suite"


8.
Double-click the Encrypt button to create a button click event handler, and then add the following code to the event handler.

Try
{
Creates a Encryptor object, specifying 3DES as
Encryption algorithm
Encryptor enc = new Encryptor (encryptionalgorithm.tripledes);
Gets the connection string as a byte array
byte[] plaintext = Encoding.ASCII.GetBytes (Txtconnectionstring.text);
byte[] key = Encoding.ASCII.GetBytes (Txtkey.text);

Performing encryption
byte[] ciphertext = enc. Encrypt (plaintext, key);
Store initialization vectors, decryption requires
The vector
Txtinitializationvector.text = Encoding.ASCII.GetString (ENC.IV);

Display encrypted string
Txtencryptedstring.text = convert.tobase64string (ciphertext);
}
catch (Exception ex)
{
MessageBox.Show ("Exception occurred while encrypting:" + ex.) Message,
"Encryption test sleeve");
}


9.
Return to Form1 in designer mode, and then double-click the Decrypt button to create a button click event handler.

10.
Add the following code to the decryption button event handler.

Try
{
Set the Decryptor object
decryptor Dec = new Decryptor (encryptionalgorithm.tripledes);

Set initialization vector
DEC.IV = Encoding.ASCII.GetBytes (Txtinitializationvector.text);

byte[] key = Encoding.ASCII.GetBytes (Txtkey.text);
Perform decryption
byte[] plaintext = Dec. Decrypt (Convert.frombase64string (
Txtencryptedstring.text),
Key);

Displays the decryption string.
Txtdecryptedstring.text = Encoding.ASCII.GetString (plaintext);
}
catch (Exception ex)
{
MessageBox.Show ("An exception occurred while decrypting.) "+ Ex." Message,
"Encryption test sleeve");
}


11.
Return to Form1 in designer mode, and then double-click the Write Registry Data button to create a button click event handler.

12.
Add the following code to the event handler.

Creating registry keys and named values
RegistryKey RK = Registry.LocalMachine.OpenSubKey ("Software", true);
RK = RK. CreateSubKey ("TestApplication");

Writes an encrypted string, initialization vector, and key to the registry
Rk. SetValue ("connectionString", Txtencryptedstring.text);
Rk. SetValue ("Initvector", convert.tobase64string (
Encoding.ASCII.GetBytes (Txtinitializationvector.text)));
Rk. SetValue ("Key", Convert.tobase64string (Encoding.ASCII.GetBytes) (
Txtkey.text)));
MessageBox.Show ("Data has been successfully written to the Registry");


13.
Run the application, and then click Encrypt. The encrypted connection string is displayed in the encrypted string field.

14.
Click "Decrypt".
The original string is displayed in the Decrypt string field.

15.
Click Write registry data.

16.
In the message box, click OK.

17.
Run Regedit.exe and view the contents of the following registry key.

Hklm\software\testapplication

Confirm that the encoded value is the current value of the connectionString, Initvector, and key named values.

18.
Close the Regedit and test suite application.



Back to the top of the page
Creating ASP.net Web applications
This process develops a simple asp.net Web application that retrieves the encrypted connection string from the registry and decrypts it.

• Create ASP.net applications

1.
Create a new Visual C # asp.net Web application named Encryptionwebapp.

2.
Adds a reference to the Encryption.dll assembly.
To create this assembly, you must perform the steps described in creating the cryptographic library in this guide.

3.
Open Webform1.aspx.cs and add the following using statement below the existing using statement at the top of the file.

Using encryption;
Using System.Text;
Using Microsoft.Win32;


4.
Add the controls listed in table 2 to the WebForm1.aspx.

Table 2:webform1.aspx Control

Control text ID
Label

Lblencryptedstring

Label

Lbldecryptedstring

Button
Get connection string
Btngetconnectionstring


5.
Double-click the Get Connection string button to create a button-clicking event handler.

6.
Add the following code to the event handler.

RegistryKey RK = Registry.LocalMachine.OpenSubKey (
@ "Software\testapplication", false);
Lblencryptedstring.text = (string) rk. GetValue ("connectionString");

String initvector = (string) rk. GetValue ("Initvector");
String strkey = (string) rk. GetValue ("key");

decryptor Dec = new Decryptor (encryptionalgorithm.tripledes);
DEC.IV = convert.frombase64string (initvector);

Decrypting a string
byte[] plaintext = Dec. Decrypt (Convert.frombase64string (
Lblencryptedstring.text),
Convert.frombase64string (strkey));

Lbldecryptedstring.text = Encoding.ASCII.GetString (plaintext);


7.
On the Build menu, click Build Solution.

8.
Right-click WebForm1.aspx in Solution Explorer, and then click View in Browser.

9.
Click Get connection String.
The encrypted and decrypted connection string is displayed on the Web form.



Back to the top of the page
Other resources
For more information, see How to create an encrypted library in this guide.