Improving Web Application Security: Threats and - CGISecurity

Chapter 7: Building Secure Assemblies 177Version 1.1 of the .NET Framework loads the user profile for the ASPNET accountused to run Web applications on Windows 2000. Version 1.0 of the .NET Frameworkdoes not load the profile for this account, which makes using DPAPI with the userkey more difficult.If you use the machine key option, you should use an ACL to secure the encrypteddata, for example in a registry key, and use this approach to limit which users haveaccess to the encrypted data. For added security, you should also pass an optionalentropy value to the DPAPI functions.Note An entropy value is an additional random value that can be passed to the DPAPICryptProtectData and CryptUnprotectData functions. The same value that is used to encrypt thedata must be used to decrypt the data. The machine key option means that any user on thecomputer can decrypt the data. With added entropy, the user must also know the entropy value.The drawback with using entropy is that you must manage the entropy value as youwould manage a key. To avoid entropy management issues, use the machine storewithout entropy and validate users and code (using code access security) thoroughlybefore calling the DPAPI code.For more information about using DPAPI from ASP.NET Web applications, see“How To: Create a DPAPI Library,” in the How To section of “Building SecureASP.NET Applications,” at http://msdn.microsoft.com/library/en-us/dnnetsec/html/SecNetHT07.asp.Do Not Store Keys in CodeDo not store keys in code because hard-coded keys in your compiled assembly can bedisassembled using tools similar to ILDASM, which will render your key in plaintext.Restrict Access to Persisted KeysWhen storing keys in persistent storage to be used at runtime, use appropriateACLs and limit access to the key. Access to the key should be granted only toAdministrators, SYSTEM, and the identity of the code at runtime, for examplethe ASPNET or Network Service account.When backing up a key, do not store it in plain text, encrypt it using DPAPI or astrong password and place it on removable media.