Groups | Blog | Home
all groups > dotnet security > january 2007 >

dotnet security : RSA encryption across domains


Juan Romero
1/10/2007 5:54:08 PM
Guys,

I have a small class in a web app that encrypts and decrypts values using
the RSACryptoServiceProvider class, using the machine key store. The code
works fine and I am able to encrypt/decrypt information fine in my
application.

However, the encrypted information is being stored in a database, which I
later try to access from another web app, which is unable to decrypt the
information and throws a "Bad Data" error. Both web apps reside in the same
server, only different host headers (websiteA.com, websiteB.com)

Does anybody know why I am unable to decrypt this? Is the store keeping
different key information for each domain?

Thank you in advance, you can reach me at
juanr<ATSIGN>vantageapparel<DOT>com





Valery Pryamikov
1/12/2007 6:01:16 AM
I guess your problem is following:
- your webersvers are running in separate application pools that uses
different users with different access.
- second app. pool doesn't have enogh right to access machine keys.
- access denied code become swallowed somewhere in your code
- and you use keypair that was generated by default when you create new
instance of RSACryptoServiceProvider.

this is most plausible explanation of your problem, but of course I
might be wrong (since this is only a guess).

-Valery
http://www.harper.no/valery

[quoted text, click to view]
Juan Romero
1/12/2007 9:34:28 AM
Valery,

Thank you for your efforts. We have a single web server and both
applications are running in the same pool. I am indeed using the keypair
that was generated by default when the first new instance was created.

Any other ideas?

Thanks again!


[quoted text, click to view]

AddThis Social Bookmark Button