Encrypt sensitive information in web.config file

Introduction

Certain sections of web.config file can be encrypted using "Protected Configuration" technique. In our current application, we shall be encrypting the database connection string stored in clear text format.

Implementation guidelines: Deployment Phase

1. The application should be hosted in the local IIS (Production system). In the current case, the application name is TestEncrypt. The application is developed in ASP.NET 2.0.
2. Create a web.config file and use the Configuration section to specify the connection string. The connection string should be added using a Add section:
   
   

   <configuration>
     <appSettings/>
     <connectionStrings>
       <add name="ConnectionString " connectionString="Data Source=127.0.0.1;
           Initial Catalog=TestDatabase;User ID=sa; password=TestPassword"
         providerName="System.Data.SqlClient" /></connectionStrings>
   

3. To encrypt the "ConnectionStrings" section, use the following command at the command line prompt:
   
   

   aspnet_regiis -pe "connectionStrings" -app "/TestEncrypt"
   

4. Once encryption is successful, the web.config file will look like:
   
   

   <configuration>
       <appSettings/>
     <connectionStrings configProtectionProvider=

   "RsaProtectedConfigurationProvider">
       <EncryptedData Type="http://www.w3.org/2001/04/xmlenc#Element"
         xmlns="http://www.w3.org/2001/04/xmlenc#">
         <EncryptionMethod Algorithm="http://www.w3.org/2001/04/

   xmlenc#tripledes-cbc" />
         <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
           <EncryptedKey xmlns="http://www.w3.org/2001/04/xmlenc#">
             <EncryptionMethod Algorithm="http://www.w3.org/2001/04/

   xmlenc#rsa-1_5" />
             <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
               <KeyName>Rsa Key</KeyName>
             </KeyInfo>
             <CipherData>
               <CipherValue>I/07jVrRIOKHgUk2jmJJkuIfp</CipherValue>
             </CipherData>
           </EncryptedKey>
         </KeyInfo>
         <CipherData>
           <CipherValue>ClC9khGOCclEFd9MjXOM0FTg</CipherValue>
         </CipherData>
       </EncryptedData>
     </connectionStrings>
   

5. Provide access to the user account under which ASP.NET is running. By default, on Windows Server 2003 with impersonation for an ASP.NET application disabled in the Web.config file, the identity under which the application runs is the NETWORK SERVICE account. On other versions of Windows, ASP.NET runs under the local ASPNET account (MACHINENAME\ASPNET). Use the following code snippet(in C#) to find out the value of current user account:
   
   

   <% Response.Write(System.Security.Principal.
                   WindowsIdentity.GetCurrent().Name); %>
   

6. At the command prompt, execute the following command to grant permissions to the User Account:
   
   

   aspnet_regiis -pa "NetFrameworkConfigurationKey" ""

7. To edit encrypted values(for future change), decrypt the connectionStrings using the following command line parameter:
   
   

   aspnet_regiis -pd "connectionStrings" -app "/testEncrypt"
   

8. Make the necessary changes to the connection string in clear text and repeat step 3 to encrypt the new values.

References

• http://msdn2.microsoft.com/en-us/library/53tyfkaw.aspx

Note

The same can be done at the development phase by providing an admin utility to encrypt and decrypt the connection string. Refer to the download file at the beginning at the article for the same.