Shulou(Shulou.com)06/01 Report--

This article will explain in detail the case analysis of DataProtection key security in .net Core distributed deployment. The content of the article is of high quality, so the editor shares it for you as a reference. I hope you will have some understanding of the relevant knowledge after reading this article.

DataProtection is used by default in .NetCore to protect data, such as Cooike, and so on. In general, keys generated by DataProtection are encrypted and stored, such as default file storage

You can see that Windows DPAPI encryption is used.

However, if you change the default settings, such as the external storage used, such as redis, the key is not encrypted by default

Microsoft explains as follows

The warning key is not encrypted, and if the redis is cracked, the system key will be compromised.

Microsoft provides two interfaces IXmlEncryptor,IXmlDecryptor to encrypt and decrypt the key. The following is a simple reality using AES, or it can be replaced with any encryption method.

The call is also simple. ProtectKeysWithAES ()

Services.AddDataProtection () .SetApplicationName ("DataProtection") .PersistKeysToStackExchangeRedis (ConnectionMultiplexer.Connect (RedisConnection), "DataProtection-Keys") .ProtectKeysWithAES ()

The encrypted key is as follows

Note: delete the previous key before generating the key, otherwise the old key will be used instead of generating a new key until the key expires.

The keys used by AES can also be protected by using a third-party KeyStore such as the Azure KeyDepot, or by using X509 certificates for encryption.

So much for the analysis of DataProtection key security examples in .net Core distributed deployment. I hope the above content can be of some help and learn more knowledge. If you think the article is good, you can share it for more people to see.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.