Wikipedia

Data Protection API

Also found in: Acronyms.

DPAPI (Data Protection Application Programming Interface) is a simple cryptographic application programming interface available as a built-in component in Windows 2000 and later versions of Microsoft Windows operating systems. In theory the Data Protection API can enable symmetric encryption of any kind of data; in practice, its primary use in the Windows operating system is to perform symmetric encryption of asymmetric private keys, using a user or system secret as a significant contribution of entropy. A detailed analysis of DPAPI inner-workings was published in 2011 by Bursztein et al.[1]

For nearly all cryptosystems, one of the most difficult challenges is "key management" - in part, how to securely store the decryption key. If the key is stored in plain text, then any user that can access the key can access the encrypted data. If the key is to be encrypted, another key is needed, and so on. DPAPI allows developers to encrypt keys using a symmetric key derived from the user's logon secrets, or in the case of system encryption, using the system's domain authentication secrets.

The DPAPI keys used for encrypting the user's RSA keys are stored under %APPDATA%\Microsoft\Protect\{SID} directory, where {SID} is the Security Identifier of that user. The DPAPI key is stored in the same file as the master key that protects the users private keys. It usually is 64 bytes of random data.

Security properties

DPAPI doesn't store any persistent data for itself; instead, it simply receives plaintext and returns ciphertext (or vice versa).

DPAPI security relies upon the Windows operating system's ability to protect the Master Key and RSA private keys from compromise, which in most attack scenarios is most highly reliant on the security of the end user's credentials. A main encryption/decryption key is derived from user's password by PBKDF2 function.[2] Particular data binary large objects can be encrypted in a way that salt is added and/or an external user-prompted password (aka "Strong Key Protection") is required. The use of a salt is a per-implementation option - i.e. under the control of the application developer - and is not controllable by the end user or system administrator.

Delegated access can be given to keys through the use of a COM+ object. This enables IIS web servers to use DPAPI.

Use of DPAPI by Microsoft software

While not universally implemented in all Microsoft products, the use of DPAPI by Microsoft products has increased with each successive version of Windows. However, many applications from Microsoft and third-party developers still prefer to use their own protection approach or have only recently switched to use DPAPI. For example, Internet Explorer versions 4.0-6.0, Outlook Express and MSN Explorer used the older Protected Storage (PStore) API to store saved credentials such as passwords etc. Internet Explorer 7 now protects stored user credentials using DPAPI.[3]

References

  1. ^ Bursztein, Elie; Picod, Jean Michel (2010). "Recovering Windows secrets and EFS certificates offline". WoOT 2010. Usenix.
  2. ^ "Windows Password Recovery - DPAPI Master Key analysis". Passcape.com. Retrieved 2013-05-06.
  3. ^ Mikhael Felker (December 8, 2006). "Password Management Concerns with IE and Firefox, part one". SecurityFocus.com, Symantec.com. Retrieved 2010-03-28.
  4. ^ "Encryption Hierarchy". Msdn.microsoft.com. Retrieved 14 October 2017.
  5. ^ "What's New in Security for Windows XP Professional and Windows XP Home Edition". Technet.microsoft.com. Retrieved 14 October 2017.
  6. ^ "ProtectedData Class (System.Security.Cryptography)". Msdn2.microsoft.com. Retrieved 14 October 2017.
  7. ^ "CookieAuthenticationOptions.TicketDataFormat Property (Microsoft.Owin.Security.Cookies)". Retrieved 2015-01-15.
  8. ^ "OAuthAuthorizationServerOptions.AccessTokenFormat Property (Microsoft.Owin.Security.OAuth)". Retrieved 2018-11-26.

External links

This article is copied from an article on Wikipedia® - the free encyclopedia created and edited by its online user community. The text was not checked or edited by anyone on our staff. Although the vast majority of Wikipedia® encyclopedia articles provide accurate and timely information, please do not assume the accuracy of any particular article. This article is distributed under the terms of GNU Free Documentation License.

Copyright © 2003-2025 Farlex, Inc Disclaimer
All content on this website, including dictionary, thesaurus, literature, geography, and other reference data is for informational purposes only. This information should not be considered complete, up to date, and is not intended to be used in place of a visit, consultation, or advice of a legal, medical, or any other professional.