I was wondering what the best (most secure) way to encrypt Web.Config files in an ASP.Net MVC 4 Application are? I have some background with developing in-house applications using C#, but we never focused too much on encryption due to other security that was already in place.
我想知道在ASP.Net MVC 4应用程序中加密Web.Config文件的最佳（最安全）方法是什么？我有一些使用C＃开发内部应用程序的背景，但由于已经存在的其他安全性，我们从未过多地关注加密。
EDIT: My host Server is ORACLE if that changes anything? A friend mentioned perhaps using aspnet_regiis.exe after deployment of my code with the '-pe' argument. Anyone have any pros/cons for this method?
编辑：我的主机服务器是ORACLE，如果它改变了什么？一位朋友提到在使用'-pe'参数部署我的代码后可能使用aspnet_regiis.exe。任何人都有这种方法的优点/缺点？
EDIT2: ORACLE is a Database, not a Server! Can I go home yet?! >_<
EDIT2：ORACLE是一个数据库，而不是服务器！我可以回家吗？！ > _ <
3 个解决方案
#1
1
The typical way is to use a ProtectedConfigurationProvider to encrypt the sensitive sections. There are several existing implementations. You can also implement your own if needed.
典型的方法是使用ProtectedConfigurationProvider加密敏感部分。有几种现有的实现方式。如果需要，您也可以实现自己的。
#2
1
I was wondering what the best (most secure) way to encrypt Web.Config files
我想知道加密Web.Config文件的最佳（最安全）方法是什么
"Most secure" depends on what threats you are trying to protect against. You can assume that all the standard cryptographic algorithms are secure, but by encrypting web.config, you've simply exchanged the problem of protecting plaintext credentials in web.config for the problem of protecting an encryption key.
“最安全”取决于您试图防范的威胁。您可以假设所有标准加密算法都是安全的，但通过加密web.config，您只需在web.config中交换保护明文凭据的问题，以解决保护加密密钥的问题。
Typically you'll use Protected Configuration to encrypt web.config.
通常，您将使用受保护的配置来加密web.config。
-
If you use the DPAPI provider, you'll encrypt using the server's machine key. This means that the encryption can be broken by anyone who can log in to the server. Also by anyone with write access to a folder containing a web site on the server, because they can upload code, say an aspx page with embedded script, that can do the decryption. This is a good choice if:
如果使用DPAPI提供程序，则将使用服务器的计算机密钥进行加密。这意味着任何可以登录服务器的人都可以破解加密。任何对服务器上包含网站的文件夹具有写访问权限的人也可以，因为他们可以上传代码，例如带有嵌入式脚本的aspx页面，可以进行解密。这是一个很好的选择，如果：
- your server is secure (not shared with other untrusted applications, e.g. a hosting environment)
- 您的服务器是安全的（不与其他不受信任的应用程序共享，例如托管环境）
- you don't want to copy the web.config to other servers (e.g. in a web farm) - it needs to be encrypted independently on each server.
- 您不希望将web.config复制到其他服务器（例如，在Web场中） - 它需要在每台服务器上独立加密。
-
Alternatively, if DPAPI doesn't meet your requirements, you should probably use the RSA provider. You can protect the key with an ACL against unauthorized access by other users on the same server, and can share it across multiple servers.
或者，如果DPAPI不符合您的要求，您应该使用RSA提供程序。您可以使用ACL保护密钥，防止同一服务器上的其他用户进行未经授权的访问，并可以跨多个服务器共享密钥。
#3
#1
1
The typical way is to use a ProtectedConfigurationProvider to encrypt the sensitive sections. There are several existing implementations. You can also implement your own if needed.
典型的方法是使用ProtectedConfigurationProvider加密敏感部分。有几种现有的实现方式。如果需要，您也可以实现自己的。
#2
1
I was wondering what the best (most secure) way to encrypt Web.Config files
我想知道加密Web.Config文件的最佳（最安全）方法是什么
"Most secure" depends on what threats you are trying to protect against. You can assume that all the standard cryptographic algorithms are secure, but by encrypting web.config, you've simply exchanged the problem of protecting plaintext credentials in web.config for the problem of protecting an encryption key.
“最安全”取决于您试图防范的威胁。您可以假设所有标准加密算法都是安全的，但通过加密web.config，您只需在web.config中交换保护明文凭据的问题，以解决保护加密密钥的问题。
Typically you'll use Protected Configuration to encrypt web.config.
通常，您将使用受保护的配置来加密web.config。
-
If you use the DPAPI provider, you'll encrypt using the server's machine key. This means that the encryption can be broken by anyone who can log in to the server. Also by anyone with write access to a folder containing a web site on the server, because they can upload code, say an aspx page with embedded script, that can do the decryption. This is a good choice if:
如果使用DPAPI提供程序，则将使用服务器的计算机密钥进行加密。这意味着任何可以登录服务器的人都可以破解加密。任何对服务器上包含网站的文件夹具有写访问权限的人也可以，因为他们可以上传代码，例如带有嵌入式脚本的aspx页面，可以进行解密。这是一个很好的选择，如果：
- your server is secure (not shared with other untrusted applications, e.g. a hosting environment)
- 您的服务器是安全的（不与其他不受信任的应用程序共享，例如托管环境）
- you don't want to copy the web.config to other servers (e.g. in a web farm) - it needs to be encrypted independently on each server.
- 您不希望将web.config复制到其他服务器（例如，在Web场中） - 它需要在每台服务器上独立加密。
-
Alternatively, if DPAPI doesn't meet your requirements, you should probably use the RSA provider. You can protect the key with an ACL against unauthorized access by other users on the same server, and can share it across multiple servers.
或者，如果DPAPI不符合您的要求，您应该使用RSA提供程序。您可以使用ACL保护密钥，防止同一服务器上的其他用户进行未经授权的访问，并可以跨多个服务器共享密钥。