Encrypt the configuration group System.ServiceModel in App.config

Question

We are deploying a client app and need to encrypt the system.serviceModel configuration group. I have been searching on StackOverflow for the better part of the day for the best way to do this and most responses have either been "rename app.config to web.config, encrypt with the ASP.NET utilty, and deploy" or "override the install method to protect the sections".

We are using ClickOnce so app is installed on a per user basis so we'll probably use DPAPI per user.

I know how to encrypt/unencrypt sections via Protect/Unprotect section but I can't figure out the best place to call these.

Some shots in the dark:

Call protect on install, unprotect on app launch, and protect on app close.

Call protect on install, unprotect is automagically done. This confuses me as I cannot find the underlying ways that DPAPI does its magic and I don't trust something I don't understand.

Answer 1

Why do you need to specifically "unprotect" on app launch? .NET will transparently decrypt those entries for you.

So basically:

• encrypt on install on that machine that the file is going to reside on
• use it just like always!

There's no need to keep decrypting the .NET configuration sections - .NET will do this as needed. This way, you can leave your MyApp.exe.config fully or partially encrypted, on disk, and only in memory, you'll have some entries that are decrypted.

Check out Jon Galloway's blog post on the topic.