DPAPI can be used to encrypt the secret data.
We intend to use it in our web app to encrypt some data and store the encrypted data in database. When needed we decrypt the data and present them on UI(web page). It works well if we hosted the web app on a single web server. But the problem appears when we migrate it to a load balance environment - hosting the web app on multiple web server. Because the app cannot decrypt the data which encrypted on another machine.

We refer to some information from internet, it looks like we need to config a roaming user account and run the application pool with that account.

The reason we want to use DPAPI is that it will not involve additional management work on the keys.

Do you have some similar experience, how do you solve the problem? Or some other suggestions?


There are two relatively small changes you should make to your setup.

First of all, you should always be using DPAPI in USER_MODE, this is a parameter to the DPAPI methods.
(The .Protect() methods of ProtectedData and ProtectedMemory classes take an additional scope parameter, this should be set to DataProtectionScope.CurrentUser for ProtectedData, or MemoryProtectionScope.SameLogon for ProtectedMemory, depending on which you are using.) (If you are calling the WINAPI functions directly, which I hope you're not using, you can send the USER_MODE parameter directly too. Oh, and use the .NET classes instead.)

Secondly, you should be using the DPAPI classes to encrypt your encryption key - not the data directly.
In other words, you generate a single encryption key, distribute this to all your servers, and have them store the key via DPAPI. (Yes, you'll probably need a small utility for this.)
This will make any key management processes much easier, the key is shared so decryption is easier, and it is still protected by the DPAPI encryption.

  • thanks avid, I did use DataProtectionScope.CurrentUser to do the encryption and decription. But I am not quite understand your second point. why I cannot encrypt the data directly, instead just encrypt the encryption key. Is it a normal approach to do the similar things? If encrypt the keys with DPAPI, I will face the same situation which is the app cannot decrypt the encryption key encrypted by another machine. You might have some experience on DPAPI. Is roaming user profile necessary if we want to use DPAPI and the CurrentUser in a load balance environment? – Robin Xing Mar 5 '12 at 9:22
  • You dont need the user to be a roaming user, that only affects the location of the user profile storage. In your case, you're saving the encrypted data yourself, after it is encrypted according to the user's account - dont worry about that part. In any event - yes, you should be having a single shared key for encryption, and using DPAPI for protecting the key in storage. – AviD Mar 5 '12 at 9:35
  • +1 on the small utility. Too many people stick the key in the app config to do the install and forget about it. – Steve Mar 5 '12 at 19:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.