Asp.net keystore password storage?

Question

I know that encrypted passwords can be stored in the web.config file, and hashed and salted passwords can be stored in the database, but can passwords be stored as a key store?

Is it even a good idea to store a keystore to store the “service account” passwords that the application needs?

Answer 1

The closest equivalent to the Java key store in the .NET / Windows world is DPAPI ( http://en.wikipedia.org/wiki/Data_Protection_API ). It stores encrypted values ​​in the Windows registry with an encryption key obtained from secrets of the system level or user account.

It is quite widely used, although an article with a detailed description of the crack ( Google Docs ) was released at the Black Hat DC 2010 conference.

Prior to this document (and if MS corrects it at some point), I would strongly recommend DPAPI exactly what you are describing.

At this point, using DPAPI is probably (and unfortunately) the best option. The mitigating factor is that the crack is very technical, difficult to perform and requires a fairly large amount of OS access to remove. Violation of the DPAPI key will most likely be removed by a trusted insider with access to the system, unlike an external attacker.