Encryption Question

We have some .dlls that we have written that use config files to store
configuration information such as usernames and passwords. In a previous
posting I asked for some suggestions for encrypting the passwords. Someone
suggested DPAPI and after some research this sounded like a good idea. After
implementing this solution I find that there is a problem. DPAPI decryption
is user based. The password that is stored in the config file is only
decrypted correctly if the person running the application is the same person
who encrypted it. This works fine for simple apps. However in my case the
..dlls that I've written could be called by an application, a web service or a
windows service all which may be running under the context of a different
user account.

Now that I realize this, I think DPAPI is the wrong choice. Can anyone
offer a suggestion of a simpler method of encryption. FYI: The passwords
that I'm storing aren't admin password. The are usually just domain accounts
that have rights for certain directories.
.

Relevant Pages

  • RE: DBI v2 - The Plan and How You Can Help
    ... Sam Vilain wrote: ... > Maxim Sloyko wrote: ... > May be it is just me, but having a bunch of config files is not very ... > string, which tells it, where passwords are stored. ...
    (perl.dbi.users)
  • Re: DBI v2 - The Plan and How You Can Help
    ... Sam Vilain wrote: ... the file would only need to contain passwords if the ... Config files should be for program, not for separate modules of that program. ... I don't mind if you implement this ".dbi" feature though, I just want it to be invisible:) i.e. don't check this file, if I explicitly supply username and password and show some warnings if don't. ...
    (perl.dbi.users)