How to encrypt/decrypt app.config for WinForm

[Gary Gorman]

I'm working with Visual Studio 2008 Pro SP1, .Net 3.5 SP1, on Windows XP box.
I have created a Windows application that will be distributed to multiple users over the Internet, well at least that was the plan, until I realized my app.config file exposes the connectionStrin g information to anyone to see.

I had been trying to follow a solution, provided by Steven Cheng, from a 07/2006 question asked on this forum titled "Encryption of application configuration block", which suggested using aspnet_regiis to create a custom RSA key that is supposed to allow me to encrypt my app.config on my development box; and provide a means to include a decryption routine within my deployment package.

To be honest, I'm not getting it??? First of all, creating the RSA key is anything but simple. For example, when I run the aspnet_regiis command as stated in the Microsoft documentation, http://msdn.microsoft. com/en-us/library/2w117ede.aspx, the Help screen scrolls by, as if my command syntax is wrong??

Secondly, this particular document is approaching the question as if I were working with an ASP.Net application as opposed to a Windows Form app.

All I want is to figure out how to encrypt the connectionStrin g section of the app.config file; and figure out how to decrypt the connectionStrin g section (on-the-fly) when a user uses my application on their computer.

I would really appreciate step-by-step guidance in resolving this problem.

Thanks in advance

[ThatThatGuy]

I'm working with Visual Studio 2008 Pro SP1, .Net 3.5 SP1, on Windows XP box.
I have created a Windows application that will be distributed to multiple users over the Internet, well at least that was the plan, until I realized my app.config file exposes the connectionStrin g information to anyone to see.

I had been trying to follow a solution, provided by Steven Cheng, from a 07/2006 question asked on this forum titled "Encryption of application configuration block", which suggested using aspnet_regiis to create a custom RSA key that is supposed to allow me to encrypt my app.config on my development box; and provide a means to include a decryption routine within my deployment package.

To be honest, I'm not getting it??? First of all, creating the RSA key is anything but simple. For example, when I run the aspnet_regiis command as stated in the Microsoft documentation, http://msdn.microsoft.com/en-us/library/2w117ede.aspx, the Help screen scrolls by, as if my command syntax is wrong??

Secondly, this particular document is approaching the question as if I were working with an ASP.Net application as opposed to a Windows Form app.

All I want is to figure out how to encrypt the connectionStrin g section of the app.config file; and figure out how to decrypt the connectionStrin g section (on-the-fly) when a user uses my application on their computer.

I would really appreciate step-by-step guidance in resolving this problem.

Thanks in advance

If you have the RSA encryption code ...
Then use it to encypt the connection string and store it in app.config..

Then while using it in the application get the string and decrypt it.. as simple as that

[Gary Gorman]

Thanks for the quick reply ThatThatGuy!

I did not to that point of receiving the encryption code. As I stated, while trying to run the aspnet_... command the resulting action was the screen scrolled by as if I had some sort of syntax error.

But if I am successful generating the RSA code are you saying I simply cut & paste it into the app.config file?

If you would please provide me with an example of what you are saying.

Also, I forgot mention in my origial post, my SQL server is on a shared hosting service and I do not have access to its command prompt to run the aspnet_... command to Grant access to the account user.