Config Data Encryption
GCSSecurity (34.9 KB)IntroductionHands off crypto - useful for protecting app.config values and performing install time machine fingerprinting...BackgroundRecently I was asked to provide better security / encryption on several data items normally contained within a CONFIG file.......
Introduction
Hands off crypto - useful for protecting app.config values and performing install time machine fingerprinting...Background
Recently I was asked to provide better security / encryption on several data items normally contained within a CONFIG file.... for example a connection string or other sensitive data values. Of course this is a trivial task these days with the security classes available in the .NET world. However, these techniques require some sort of Key/Salt values which in turn become sensitive data values that require protection. Oh Mama make it stop. So the goal becomes one of making encryption/decryption self contained - in other words secure to each machine / instance without the need for any user involvement or support staff maintenance. Our first step will be conjuring up some unique and repeatable strings for use as a key/salt value pair. I remembered some old techniques for digging out serial numbers for specific components on the computer system. Using a collection of these values - and passing the result to a HASH generator - we can easily produce a unique string of 32 characters. See the FingerPrint class in the source code for this bit of magic. Once we have a repeatable hash string - we can easily pick off fixed portions of it for the key/salt value pairs - the Fingerprint class offers both 8 and 16 character sub parts of the fingerprint by pealing off the leading chars for the key and the trailing chars for the salt.FingerPrint
- Provides 32 character (hash) of machine FingerPrint
- This class provides Static methods from which one can obtain the right and left 8 chars of the Fingerprint
- These 8 char keys are assumed by Crypto to be the Key/Salt values used in DESCrypto
System.Security.Cryptography namespace - I chose DES... And create a simply Crypto class.
Crypto
- Provides string encryption and decryption services
- This class exposes two methods (Encrypt and Decrypt) into which one is expected to pass a data string to cypher
- Decrypt of course expects a encrypted string to decrypt
- Encrypt of course expects a raw text string to encrypt.
- Decrypt and Encrypt are overridden allowing passing of Key and/or Salt values to be used.
Using the Code
Step 1
Reference the GCSSecurity.dll assembly in your projectStep 2 Declare an instance of the Crypto Class
C#
GCS.Security.Crypto _crypto = new GCS.Security.Crypto();
VB
Dim _crypto as New GCS.Security.Crypto()
Step 3.a
To encrypt a string:C#
String encrypted = _crypto.Encrypt("my raw text string");
VB
Dim encrypted As String = _crypto.Encrypt("my raw text string")
Step 3.b
To decrypt an encrypted string:C#
String decrypted = _crypto.Decrypt(encrypted);
VB
Dim decrypted As String = _crypto.Encrypt(encrypted)
The source provided also contains a tester application which contains working handlers for all the above.
By making use of the ConfigurationManager class we can now easily hide sensitive values in the application CONFIG file using code something like this...
Configuration config = ConfigurationManager.OpenExeConfiguration(ConfigurationUserLevel.None);
if (config.AppSettings.Settings["myKey"] != null)
{
config.AppSettings.Settings["myKey"].Value = _crypto.Encrypt("My RAW data value");
}
config.Save(ConfigurationSaveMode.Modified);