c# - When encrypting web.config connection string, where is the key stored? -

when encrypting connection string in web.config, key stored?

also, need re-compile when change connection string credentials?

according this documentation have 2 providers when encrypting configuration:

• rsaprotectedconfigurationprovider
• dpapiprotectedconfigurationprovider

i have little knowledge dpapi can not or against it. when considered use encryption of web.config chose rsa , defined other csp hold rsa encryption key. can set in machine.config in configprotecteddata element.

the mentioned page describes , guides how encrypt web.config sections using rsaprotectedconfigurationprovider. when using provider, have 2 options

• machine-level container (rsa key stored in \documents , settings\all users\application data\microsoft\crypto\rsa\machinekeys)
• user-level key container (rsa key stored in \documents , settings{username}\application data\microsoft\crypto\rsa)

the guide describes how use aspnet_regiis.exe tool rsaprotectedconfigurationprovider encrypt sections of configuration file.

to answer second question. not need re-compile application have decrypt section (connection string), change credentials , encrypt section again. or replace web.config new 1 , encrypt again.

pleas note when encrypting section have have encryption key on same machine web.config. guide mentions how export rsa key 1 machine , import usage in web farms.

but think moment: when application can decrypt web.config (because has before using connection string) can (if can machine). know permissions use key can set etc. etc. imho wrong practice use passwords in connection string.

one last thing. aspnet_regiis.exe tool mentioned in guide above can encrypt web.config. if have app.config , want encrypt it, @ this question.