How To Encrypt Data In An ASP.NET Application

In this article I will discuss how to go about protecting data within an ASP.NET application which will encrypt the data to ensure that it can’t be read by anyone or anything that’s not supposed to see it.

What Data Should You Protect?

When you want to protect your Web.Config file, the answer is reasonably obvious, connection strings are most common, but you might also have other settings that you would want to keep safe.
However, what about data outside of the Web.Config files?
A common use is when you want to place a token of some kind in the html of a page, or perhaps a value you want to store in a cookie and check later.


Never expose anything in a cookie, on a page or anywhere public  that you truly need to keep secure.  Anything that’s encrypted can be decrypted if the attacker is determined enough.
Also, in a web farm scenario, you’ll have to ensure that all of the servers have the same machine key in the machine.config file, otherwise one server may encrypt something, but another server may be unable to decrypt it, as the encryption is based off of the MachineKey

How It Works:

In .Net 4.5 the process is very simple:

  • Convert the data you want to protect into a byte array
  • Pass the byte array to the MachineKey.Protect() method in the System.Web.Security; namespace.
  • Your data is now protected.
  • You may want to convert this into a string to pass around.
  • To decrypt the data, simply pass the byte array representing the encrypted text to the MachineKey.Unprotect() method.

Implementation Example:

    //The data you want to encrypt
    string mySecretData = "This is a secret.";
    //An array of tokens which define what should be able to access this data
    string[] myPurposes = new string[] { "purpose1", "purpose2", "purpose3" };
    //Secret data is being converted to a byte array (Required for the Protect method)
    byte[] myOriginalByteArray = Encoding.ASCII.GetBytes(mySecretData);
    //byte array representation of the secret data is encrypted into a byte array
    byte[] myProtectedByteArray = MachineKey.Protect(myOriginalByteArray, myPurposes);
    //remove the decrypt the secret data into a byte array
    byte[] myUnProtectedByteArray = MachineKey.Unprotect(myProtectedByteArray, myPurposes);
    //Convert the protected and unprotected byte arrays to strings so you can see the difference
    string protectedText = Encoding.Default.GetString(myProtectedByteArray);
    string unprotectedText = Encoding.Default.GetString(myUnProtectedByteArray);

The mySecretData variable is the data that I’m going to protect.
The myPurposes variable is a string array containing 3 example strings representing the purposes that are intended for this data. representing the purposes that are intended for this data.

Once you encrypt something with a specified purpose, the data can only be decrypted when the exact same purposes are specified.
Although I’ve specified 3, it’s probably more common to have just one, but you can have as many as you like.
You could for example encrypt data for each user of your website, where the purpose could be their username.

Next you need to convert your data into a byte array and for that I use the Encoding.ASCII.GetBytes() method in the System.Text namespace.

Now comes the part where the encryption actually happens.
I’ve used MachineKey.Protect() passing in our secret data byte array and our string array of purposes which are intended to access this data.
This method outputs another byte array, but is encrypted, so anyone trying to convert that back into a string will get a bunch of gibberish.

To decrypt the data we just need to use the MachineKey.Unprotect() method, passing in the encrypted byte array as well as the string array of purposes.
The output of this method is the decrypted byte array, which we can then convert back into a string to examine it’s content, as long as no-one has tampered with it (Discussed in another article), the value will be the same as the original value you specified.

In my example, you can just compare the value of the protectedText and unprotectedText variables.

By default, the encryption algorithm is AES and can have a decryption key manually set to 32, 48 or 64 characters long (Longer is more secure), or it can be set to AutoGenerate which will automatically generate a the key for you.

If you enjoyed this article, please consider giving it a +1

Tags: encryption,, machinekey

Published: 5/25/2014 2:22:51 PM
By: Stephen Warren