Where to store sensitive data in a C# assembly?

Question

Given that a C# assembly can be easily reverse engineered using reflector, where should I store my sensitive data when compiling an assembly in C#?

I have a X509certificate embedded in my C# assembly in which I need to store the password when accessing the certificate! Now where should I store the certificate password?

Wolverine

You can't. Anything that your code can access, the user can also access. – Politics

Encryption would be your only option: support.microsoft.com/kb/316898 But ultimately, nothing is secure. – Rhys

Keep you sensitive data in protected (encrypted) mode. – Peridium

any other solutions? an unmanaged library maybe? – Wolverine

You can encrypt part of your app.config file: weblogs.asp.net/jgalloway/archive/2008/04/13/… – Davon

The consensus is that it can't be done. See here and here. – Warship

@Anon: Encryption doesn't help in the slightest. – Politics

@Sepehr: No. The user has complete control over anything running on his machine. – Politics

The best I've used is Secure Team (secureteam.net/NET-Obfuscator-Features.aspx) but its not cheap. – Corpuz

Answer 1

If you don't mind shelling out some cash, you could take a look at Eazfuscator

The vendor claims to offer Code virtualization, string encryption among other features.

If his claims are valid, this might be what you need.

They have a trial, so i guess it can't hurt to try it out.

Mckie