Can you programmatically configure MachineKey?

Question

In ASP.NET, can you programmatically configure machineKey parameters?

The web application that we use to store confidential information encrypted in the database, so if we could put decryptionKey there, it would be convenient.

Answer 1

No; machineKey element must be set via config. However, web.config can be encrypted, which helps minimize the risk of cryptographic key disclosure if an attacker ever accesses a configuration file. (The same process can be used to protect the SQL connection strings and almost any other sensitive configuration element that you want.) See http://msdn.microsoft.com/en-us/library/dtkwfdky(v=VS.100 ) .aspx for the pass by including this.