c# - 在 app.config 中使用提供程序 'DataProtectionConfigurationProvider' 解密失败

Question

我使用以下方法在我的 WinForms 项目中加密 app.config 的 connectionstrings 部分(我在中使用 Code First EF我的项目):

public static void EncryptConfig(string exeConfigName)
{
    var config = ConfigurationManager.OpenExeConfiguration(exeConfigName);
    var section = config.GetSection("connectionStrings") as ConnectionStringsSection;
    if (section != null || !section.SectionInformation.IsProtected)
    {
       section.SectionInformation.ProtectSection("DataProtectionConfigurationProvider");
       config.Save();
    }
}

我也使用以下方法解密 connectionstrings 部分:

public static void DecryptConfig(string exeConfigName)
{
    var config = ConfigurationManager.OpenExeConfiguration(exeConfigName);
    var section = config.GetSection("connectionStrings") as ConnectionStringsSection;
    if (section != null && section.SectionInformation.IsProtected)
        section.SectionInformation.UnprotectSection();
}

此方法适用于我的机器，但是当我将我的应用程序部署到另一台机器时，出现以下异常:

System.Configuration.ConfigurationErrorsException: Failed to decrypt using provider 'DataProtectionConfigurationProvider'. Error message from the provider: Key not valid for use in specified state. (Exception from HRESULT: 0x8009000B) (D:\l4test\Level4UI.exe.config line 82) ---> System.Runtime.InteropServices.COMException: Key not valid for use in specified state. (Exception from HRESULT: 0x8009000B)

at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)

at System.Runtime.InteropServices.Marshal.ThrowExceptionForHR(Int32 errorCode)

at System.Configuration.DpapiProtectedConfigurationProvider.DecryptText(String encText)

at System.Configuration.DpapiProtectedConfigurationProvider.Decrypt(XmlNode encryptedNode)

at System.Configuration.ProtectedConfigurationSection.DecryptSection(String encryptedXml, ProtectedConfigurationProvider provider)

at System.Configuration.Internal.InternalConfigHost.System.Configuration.Internal.IInternalConfigHost.DecryptSection(String encryptedXml, ProtectedConfigurationProvider protectionProvider, ProtectedConfigurationSection protectedConfigSection)

at System.Configuration.Internal.DelegatingConfigHost.DecryptSection(String encryptedXml, ProtectedConfigurationProvider protectionProvider, ProtectedConfigurationSection protectedConfigSection)

at System.Configuration.Internal.DelegatingConfigHost.DecryptSection(String encryptedXml, ProtectedConfigurationProvider protectionProvider, ProtectedConfigurationSection protectedConfigSection)

at System.Configuration.BaseConfigurationRecord.CallHostDecryptSection(String encryptedXml, ProtectedConfigurationProvider protectionProvider, ProtectedConfigurationSection protectedConfig)

at System.Configuration.BaseConfigurationRecord.DecryptConfigSection(ConfigXmlReader reader, ProtectedConfigurationProvider protectionProvider)

--- End of inner exception stack trace ---

at System.Configuration.BaseConfigurationRecord.EvaluateOne(String[] keys, SectionInput input, Boolean isTrusted, FactoryRecord factoryRecord, SectionRecord sectionRecord, Object parentResult)

at System.Configuration.BaseConfigurationRecord.Evaluate(FactoryRecord factoryRecord, SectionRecord sectionRecord, Object parentResult, Boolean getLkg, Boolean getRuntimeObject, Object& result, Object& resultRuntimeObject)

at System.Configuration.BaseConfigurationRecord.GetSectionRecursive(String configKey, Boolean getLkg, Boolean checkPermission, Boolean getRuntimeObject, Boolean requestIsHere, Object& result, Object& resultRuntimeObject)

at System.Configuration.Configuration.GetSection(String sectionName)

at IASCo.Infrastructure.Common.Utilities.Configuration.ConfigurationEncryption.DecryptConfig(string exeConfigName)

在this thread , Jeremy说:

You need to publish with the section decrypted. The key that is used to encrypt/decrypt is machine specific.

我的应用程序将安装在网络共享上并从那里运行，但是会有不止一个人可以从他们的工作站访问该应用程序，我如何指定一个 key 来解密 connectionString 部分将在所有用于访问该应用程序的机器上运行。

我正在寻找一种使用 C# 完成这项工作(在我的机器上加密并在用户的机器上解密)的方法。

Answer 1

你的代码对我来说很好——除了需要从

的用户那里改变

 if (section != null || !section.SectionInformation.IsProtected)
{
   section.SectionInformation.ProtectSection("DataProtectionConfigurationProvider");
   config.Save();
}

到

 if (section != null || !section.SectionInformation.IsProtected)
    {
       section.SectionInformation.ProtectSection("RsaProtectionConfigurationProvider");
       config.Save();
    }

当您创建 RSA key 时，请确保您使用 -exp 开关根据文档启用 key 导出:https://msdn.microsoft.com/en-us/library/yxw286t2.aspx

aspnet_regiis -pc "KeysetName"–exp

正如前面回答者所说。除此之外，如果应用程序的用户在 IIS 网络上，您可以使用 ASP.NET 模拟 vis 您的组织访问控制列表 (ACL)。这将使您无需在机器级别进行身份验证，这并不适合所有应用程序。请参阅:https://msdn.microsoft.com/en-us/library/xh507fc5.aspx