My goal is to implement asymmetric encryption in an ASP.NET website to secure user-entered Social Security Numbers. I want to encrypt the SSNs with a public key, and only display a masked version, to the user (ie
XXX-XX-1234). (A separate application running apart from the website will have access to the private key and decrypt the SSNs to transfer them to another system.)
I'm trying to use the built-in
RSACryptoServiceProvider but I keep getting an error:
The system cannot find the file specified.
It runs to just fine on my own machine, because I'm an admin on my machine. But on the server (Windows 2008 R2 Standard), it errors out. The website is running as
I saw on a tutorial that I would need to give IIS NTFS permission for
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA. The reason is that supposedly the RSA API writes temp files to that folder, even if you give it the keys in memory. But I've tried different combinations of users and permissions and nothing's worked.
I realize I could put the public/private key pair in a key container and use
aspnet_regiis.exe to grant IIS access to the key, but that defeats the purpose of keeping the private key separate from the website. I'm also concerned that giving IIS access to this folder would also compromise the other system key containers stored there.
How do I get ASP.NET to work with
RSACryptoServiceProvider? Or should I just use some other method to do RSA encryption?