Why encrypt a web config file?

11
votes

As far as I can tell, any section in a web.config file can be encrypted & decrypted using aspnet_regiis.exe.

If aspnet_regiis can be used to decrypt the web.config file, then what's the point of encrypting it? Is it just to keep passwords & sensitive information from being stored as plain text? If anyone with the file and the exe can decrypt it, does it really protect sensitive config info?

UPDATE

Thanks to everyone who answered regarding the machine key. The reason I asked this question is because we have an open source project hosted at codeplex.com. However, we also deploy this project to Windows Azure. I am trying to find a best approach to keep the sensitive passwords out of source control, but keep them accessible as part of my project for when I deploy to Azure.

Currently, I am using web config transforms to store the Azure connection strings (as well as Gmail passwords for system.net). I've created a Web.PublishToAzure.config transform file, and just kept that file out of source control. I also found this article which may be a better option. Thanks again.

4
asp.netweb-configpasswordsencryption
The link to "this article" doesn't exists. I would really like to have a look at if possible. Thanks. – Parth Shah

4 Answers

10
votes

The file is encrypted using machine-specific keys. While it is true that anyone with machine-level access could decrypt it, encrypting it would stop people with FTP access since they don't have the machine's DPAPI keys.

6
votes

My understanding is that the aspnet_regiis.exe uses a machine specific key as a "salt"

If you encrypt a section on a machine, and then take the config to another machine and try to decrypt it, it will not work.

6
votes

In history, there were exploits in browsers or web server software that allowed users to view any file on the server's hard drive. In a case such as this, the encrypted web.config file could be of some use. However if a web server has been compromised allowing remote access to the server itself, then having an encrypted web.config file will be the least of your worries.

3
votes

Simplistic answer: they won't have access to the key

I believe by default the key is stored in the machine's certificate store, so a malicious user would need to have access to that too. I'm not an expert but that's the gist of it.