Enterprise Library Test Guide - Willy .Net

146
Enterprise Library Test Guide
Check
Yes
Description
Use DPAPI to encrypt configuration secrets so as to eliminate the key management
issue. (DPAPI uses the password of the user account associated with the code that
calls the DPAPI functions in order to derive the encryption key. As a result, the operating
system, and not the application, manages the key.) The Cryptography Application
Block uses DPAPI to encrypt the key. It retrieves the key from the key file or cache each
time it must encrypt or decrypt information. The following code example shows how the
Cryptography Application Block stores and retrieves the key.
public static ProtectedKey Read(string protectedKeyFileName, DataProtectionScope
dpapiProtectionScope)
{
string completeFileName =
Path.GetFullPath(protectedKeyFileName);
if (cache[completeFileName] != null) return
cache[completeFileName];
using (FileStream stream = new
FileStream(protectedKeyFileName, FileMode.Open,
FileAccess.Read, FileShare.Read))
{
ProtectedKey protectedKey = Read(stream,
dpapiProtectionScope);
cache[completeFileName] = protectedKey;
return protectedKey;
}
}
The following code example shows how to use DPAPI to decrypt the key.
public byte[] Encrypt(byte[] plaintext)
{
byte[] output = null;
byte[] cipherText = null;
this.algorithm.Key = Key;
private byte[] Key
{
get
{
return key.DecryptedKey;
}
}
}
public byte[] DecryptedKey
{
get { return Unprotect(); }
}
public virtual byte[] Unprotect()
{
return ProtectedData.Unprotect(protectedKey, null,
protectionScope);
}