Questions tagged [windows-dpapi]

The Windows Data Protection API (DPAPI) provides operating system-level data protection services to user and system processes.

Filter by
Sorted by
Tagged with
1
vote
0answers
46 views

Which attributes does DPAPI's “UseMachineProtection” use to identify a machine?

We're using DPAPIProtectedConfigurationProvider from the Windows Data Protection API to encrypt an application config file. The API offers a property called UseMachineProtection, so that the config ...
0
votes
1answer
77 views

DPAPI Decryption

An application I am looking to use is using DPAPI to encrypt a Client Secret as part of a OAuth2 Authentication flow. A domain service account will be used for encryption with the password stored in ...
1
vote
0answers
66 views

How do SDDL protection descriptors work with CNG DPAPI

NCryptCreateProtectionDescriptor accepts various Protection Descriptors, and I can understand the examples shown like: SID=S-1-5-21-4392301 But the examples also show SDDL based descriptors, like: ...
1
vote
1answer
170 views

Is it appropriate to tie application-level encryption keys to AD profile

The underlying tech is Windows DPAPI and .NET's use of it via ProtectedData. In our scenario, we have an application that runs across various servers, Web Api's, websites that users can log into and ...
3
votes
1answer
189 views

Why does my DPAPI data start with the same bits?

I am using the DPAPI C# ProtectedData class to encrypt some information stored in the database. I am using it both with and without the optionalEntropy. Encrypting the same data multiple times, the ...
1
vote
1answer
752 views

Storing credentials for desktop app

I have desktop application written in C# with three user roles and some predefined users. It is also possible to create another users or change passwords to predefined users. App has to work offline ...
7
votes
2answers
917 views

Is there any reason to use AesManaged over DPAPI in this scenario?

I have a situation where my web application is going to be deployed on multiple web servers, and I'll be wanting to store some securely encrypted data on the DB servers (each web server has a DB ...
2
votes
0answers
75 views

Where should I store encrypted data so as to have app-exclusive access?

I am using windows Data Protection API (DPAPI) to protect private key used in my application. I cannot hide entropy used in DPAPI call because my application needs to be open source. Where should I ...
-1
votes
1answer
2k views

What encryption algorithm does CryptEncrypt in Crypto API use?

I am writing a code to perform encryption and decryption using CryptEncrypt and CryptDecrypt functions, a part of Windows' Crypto API. Can anyone tell me what kind of encryption these two function use?...
1
vote
1answer
943 views

How can i store encryption key into Microsoft provided Key container?

I'm working on an application in which user will enter encryption key via GUI and my app will fetch that encryption key. Now i need to store that received key into Microsoft key container. I got this ...
7
votes
1answer
769 views

How secure is my DPAPI Master Key if I enable biometric login?

I understand that Windows DPAPI master keys are encrypted (directly or indirectly) with the user's login password - see e.g. Does DPAPI works if a user hasn't a login password? If I understand ...
4
votes
0answers
899 views

copying roaming profile credential file of another computer

I am trying to recover login information of another computer. I have managed to copy the local/roaming profile credential files located in C:\users\%username%\APPDATA\local\Microsoft\Credentials\ and ...
3
votes
0answers
95 views

Storing Recoverable Passwords In An App

I'm working on a project where I need to store and recover a password. I can't use a salted hash for authentication because the password is used to secure an HTTP connection via HTTP Digest. I'm not ...
1
vote
1answer
862 views

Securing an IIS application with a complex configuration

I'm in a bit of a pickle. I've got an IIS application which accesses an SQL database (on a different machine). This already means that: a) the IIS application needs to have a connection string to ...
0
votes
1answer
299 views

Encrypting data in a load-balanced application - am I doing this right?

A web application I'm developing needs to store some sensitive data in a database. I need to be able to retrieve and use this data later on so hashing isn't enough. The web application might, at some ...
2
votes
1answer
366 views

Is it possible for me to extract my own AES disk encryption key?

I use Check Point Full Disk Encryption, but hope that this question can be answered generally. Is it possible for me to get, or extract, my own 256-bit AES key? By the way, I don't use any special ...
1
vote
0answers
231 views

What are some good design practices for cross-platform certificate storage?

Question from the Bouncy Castle development list: At present we use the Windows certificate store as: var store = new X509Store(StoreName.My, StoreLocation.LocalMachine); store.Open(OpenFlags....
4
votes
1answer
2k views

BitLocker with Windows DPAPI Encryption Key Management

Disclaimer: I realize that I posted this question on ServerFault, but I have not received any response there. I am hoping that this forum might be a more appropriate place to post this for a response....
1
vote
1answer
694 views

Where are located the DPAPI BLOBS and is there any tool to decypher them?

I'm doing some testing with DPAPI for a project where I'm involved. I would like to know where the users Masterkey are located and if there is any free utility to find and decipher them. I'm pretty ...
5
votes
1answer
813 views

Does DPAPI works if a user hasn't a login password?

I was wondering if the DPAPI will still work properly if a user doesn't have a a login password (like most of the home users). I can't find this information on Google or in the official documentation ...