在Windows应用程序保存用户凭据 [英] Saving user credentials in a Windows application

问题描述

时有一个最佳实践的方式来储存在.NET Windows应用程序凭据，无论是内置的API或只是一个推荐的加密算法？

Is there is a best practices way to store credentials in a .NET Windows application, be it be a built in API or just a recommend encryption algorithm?

沿着相同的路线乌龟SVN，Spotify的和Skype。

Along the same lines as Tortoise SVN, Spotify and Skype.

编辑：我的本意是用返回一个令牌从它的认证服务的Web服务。然后，其他服务接受令牌作为参数。然而，令牌30分钟后到期，以便存储令牌本身就毫无意义了这个任务。

My intention is to use a web service that returns a token from it's authentication service. The other services then accept that token as a parameter. However, the token expires after 30 minutes so storing the token itself it pointless for this task.

推荐答案

看来，使用<一个href="http://msdn.microsoft.com/en-us/library/system.security.cryptography.protecteddata.aspx">ProtectedData （该包装href="http://msdn.microsoft.com/en-us/library/ms995355%28loband%29.aspx"> Windows数据保护API 的

It appears that using ProtectedData (which wraps the Windows Data Protection API) is my best bet, as it has the option to encrypt based on the currently logged in user.

byte[] dataToEncrypt = new byte[] { ... };

// entropy will be combined with current user credentials
byte[] additionalEntropy = new byte { 0x1, 0x2, 0x3, 0x4 };

byte[] encryptedData = ProtectedData.Protect(
    dataToEncrypt, additionalEntropy, DataProtectionScope.CurrentUser);

byte[] decryptedData = ProtectedData.Unprotect(
    encryptedData, additionalEntropy, DataProtectionScope.CurrentUser);

这篇关于在Windows应用程序保存用户凭据的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！