Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have encrypted part of my web.config file using the Data Protection API.

Now, my question is, what does a hacker need in order to decrypt the web.config file?

Does he require physical access to the machine in order to decrypt it? Or can he decrypt it from a remote location?

share|improve this question

2 Answers 2

up vote 7 down vote accepted

It depends.

  • If the attacker gains access to your web.config alone, then he's not able to decrypt it without the key, which we're assuming he doesn't possess.

  • If you've set useMachineProtection to true in your DpapiProtectedConfigurationProvider configurations, and the attacker gains access to your machine (remote or not) with any account, then any process running on the machine could decrypt the web.config file, including anything the attacker could run.

  • If you've set useMachineProtection to false in your DpapiProtectedConfigurationProvider configurations, then the attacker needs access to the user account used for the process (remote or not).

You need to know that DPAPI provides password-based protection. So, assuming you're using option #3, then even if the attacker gains physical access to the machine, they still need the account's password to decrypt encryption keys which will decrypt the data. Of course, the attacker can easily reset the password, but that would render the encrypted keys useless and leaves your data inaccessible.

Note that until .Net 3.5 SP1, useMachineProtection is set to true (bad) by default. I have no information on later versions.

Update: .Net 4.0 uses the default value true for useMachineProtection as well.

share|improve this answer
Thank you so much for your detailed answer :) I appreciate the time that you took in order to answer my question :) Thank you :) –  Matthew Jul 23 '13 at 16:40

I'm assuming that you are working in .net or perhaps lower level like C++. From having recently consumed those APIs here is what I would recommend.

There are 2 Protected Configuration Providers available, DPAPI (more appropriate for client side desktop applications) and the RSA Provider (http://msdn.microsoft.com/en-us/library/system.configuration.rsaprotectedconfigurationprovider.aspx). The latter is more appropriate for encrypting web.configs as this is a public key configuration where only the ASP.NET service has the private key to decrypt the data, this can be scoped at both user and machine, similar to DPAPI.

Here is an old but sound walkthrough of it in ASP.Net: http://msdn.microsoft.com/en-us/library/ff650304.aspx

I apologize if you are not using .Net, it was unclear. Still though I think the RSA provider is the correct way to go here.

With regards to breaking the DPAPI encryption, yes most of the attacks would need to be orchestrated on the target machine, usually involving either an attempt at the password SAM files or password reset scripts targeted at systems admins. Here is a whitepaper on breaking DPAPI offline from BlackHat 2010 - http ://elie.im/publication/reversing-dpapi-and-stealing-windows-secrets-offline. With regards to the encryption schemes used 3DES with CBC(Cipher Block Chaining) and SHA-1 all have their own separate known weaknesses for exploitation.

share|improve this answer
Thank you so much for your answer :) I appreciate it immensely :) Yes, I am using the .NET framework. More specifically, the project is an ASP.NET website with C# as the code-behind. –  Matthew Jul 23 '13 at 16:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.