Storing Encryption Keys

[Mantorok]

Hi

Where is the most secure place to secure an encryption key for each of your
applications?

Thanks
Kev

[Tasos Vogiatzoglou]

You could use DPAPI (there is a managed API in .NET 2 and code
available for .NET 1.1) to store your keys.

This should help: http://www.eggheadcafe.com/articles/20021221b.asp

Tasos
Mantorok wrote:

Hi

Where is the most secure place to secure an encryption key for each of your
applications?

Thanks
Kev

[Cowboy \(Gregory A. Beamer\)]

The safest is to use the built in encryption schemes, like DPAPI. If this is
not an option, for some reason, put the keys in the registry where they
cannot be accessed by anyone that does not have control of the machine. You
will want to slap them in memory when the app starts up, of course, to not
have the lookup every time. A database is another "more secure option". I
would not have them on the file system, but if you have to, put them
somewhere outside of the app path (and if this is a windows app, forget
about it).

--
Gregory A. Beamer

*************************************************
Think Outside the Box!
*************************************************
"Mantorok" <ma******@mantorok.com> wrote in message
news:e5**********@newsfeed.th.ifl.net...

Hi

Where is the most secure place to secure an encryption key for each of
your applications?

Thanks
Kev

[William Stacey [MVP]]

| will want to slap them in memory when the app starts up, of course, to not
| have the lookup every time.

I agree with DPAPI, but not sure storing clear in memory is a good idea.
The best practice is to only have decrypted (i.e. clear) information for as
short of time as possible to protect against threats like dumps, memory
browsers, etc.