Security: ¿how to store an encryption key locally?

microsoft.public.dotnet.framework

4 Jan 2007 6:16 PM

Néstor Sánchez A.

Hi,
i need to know the best practice about a security issue...
For a WinForms C/S application it is required to store an encryption key
locally.
¿How can store that key to be accesible only by the application but no by
unauthorized users?
Options:
- A file: The key should be encripted, but again we have a key to store.
- Hard coded in the application: The problem here is possible decompilation
(even with obfuscation you can reach the key)
- ¿Using an OS service or another external entity?
Thanks,

Néstor.