How to manage a private key in an ASP.NET MVC application

0

I am storing a private key for some crypto methods in an ASP.NET MVC application that is implemented in C#. I am using the System.Security.Cryptography.CngKey class to create and retrieve the private key.

I create the key like this:

key = CngKey.Create(CngAlgorithm.ECDiffieHellmanP521, keyName, new CngKeyCreationParameters { ExportPolicy = CngExportPolicies.AllowPlaintextExport });

And I retrieve the key like this:

key = CngKey.Open(keyName);

This worked fine for the most part, but then on some deployments after the web application has been in production for a while I will start getting this error message when trying to retrieve the key.

Cryptographic Operation
SubjectDomainName IIS APPPOOL
ProviderName Microsoft Software Key Storage Provider
AlgorithmName ECDH_P521
KeyType User Key
Operation Open Key
ReturnCode 0x8009000b
Log Name: Security
Task Category: System Integrity

You will notice that it is using the Application Pool Identity, which is a virtual account. I am suspicious that this is happening because this is a virtual account. Keep in mind that it works fine for a while and then starts failing. Has anyone else run into this issue and found a solution? Is there a better what to manage the private key in an ASP.NET web application?

c#
asp.net-mvc
security
cryptography
asked on Stack Overflow May 26, 2016 by Kevin Junghans • edited May 26, 2016 by Kevin Junghans

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0