Encrypt Configuration Sections in ASP.NET 2.0 Using DPAPI

Question

User-270112306 posted

Hi,

As I am new to this topic, I need more information regarding this security concept.

ref doc : https://docs.microsoft.com/en-us/previous-versions/msp-n-p/ff647398(v=pandp.10)#feedback

In the above document, it is mentioned that DPAPI 

Applies To

• ASP.NET version 2.0
• Microsoft® Windows Server™ 2003 operating system

I believe it applies to the above versions and higher. 

Is it possible for someone to access the DPAPI security keys stored on the machine level.

can someone explain me the process.

Answer 1

User-939850651 posted

Hi sweetyfernandes,

DPAPI provides an easy set of APIs to easily encrypt (CryptProtectData()) and decrypt (CryptUnprotectData()) opaque data “blobs” using implicit crypto keys tied to the specific user or system. This allows applications to protect user data without having to worry about things like key management.

For more details, you could refer to below links:

Operational Guidance for Offensive User DPAPI Abuse 

How to encrypt and decrypt data using DPAPI in C# or VB.NET

Best regards,

Xudong Peng