How do you hide an encryption key in a .NET application?

Question

I\'m developing an intranet application (C#) that uses some data (local to the web server) that we\'d like to keep private. This data is encrypted (AES) using a legacy data

Answer 1

If somebody can just attach a debugger to your program, there is absolutely nothing you can do. They won't have to figure out your config, disassemble your app, etc. All they have to do is run the app - watch it use the key - bingo.

Obfuscation is of no help under those conditions.

The best defense is to use hardware to protect the key - which will do the crypto but not give out the key itself (and is sometimes hardened against attacks such as probing the wires, exposing the memory to low temperatures/radiation/other novel stuff). IBM do some appropriate stuff (google IBM-4764) but it's not cheap.