WIP Use machine key for encryption instead of ProtectSection()

Server/BackendClasses/BackendClasses.csproj

@@ -36,6 +36,7 @@
     </Reference>
     <Reference Include="System" />
     <Reference Include="System.Core" />
+    <Reference Include="System.Web" />
     <Reference Include="System.Web.Extensions" />
     <Reference Include="System.Xml.Linq" />
     <Reference Include="System.Data.DataSetExtensions" />

Server/BackendClasses/Encryption.cs

@@ -5,9 +5,37 @@
 using System.Security.Cryptography;
 using System.Text;
 using System.Threading.Tasks;
+using System.Web;
+using System.Web.Security;
 
 namespace LauncherServerClasses
 {
+    public static class MachineKeyEncryption
+    {
+        public static string Protect(string text, string purpose)
+        {
+            if (string.IsNullOrEmpty(text))
+            {
+                return string.Empty;
+            }
+
+            byte[] stream = Encoding.UTF8.GetBytes(text);
+            byte[] encodedValues = MachineKey.Protect(stream, purpose);
+            return HttpServerUtility.UrlTokenEncode(encodedValues);
+        }
+
+        public static string UnProtect(string text, string purpose)
+        {
+            if (string.IsNullOrEmpty(text))
+            {
+                return string.Empty;
+            }
+
+            byte[] stream = HttpServerUtility.UrlTokenDecode(text);
+            byte[] decodedValues = MachineKey.Unprotect(stream, purpose);
+            return Encoding.UTF8.GetString(decodedValues);
+        }
+    }
     public class Encryption
     {
         // Do not write your own encryption. Use libraries like JWT

Server/LauncherClient/Launcher.cs

@@ -6,6 +6,7 @@
 using System.Linq;
 using System.Reflection;
 using System.Windows.Forms;
+using LauncherServerClasses;
 
 namespace LauncherClient
 {
@@ -32,6 +33,8 @@ public Launcher()
                 host = new ApiHost();
                 host.StartHost();
 
+                //encryption = new Encryption("the machine key");
+
                 Configuration configuration = ConfigurationManager.OpenExeConfiguration(ConfigurationUserLevel.None);
                 baseURL = configuration.AppSettings.Settings["BaseURL"].Value;
                 computerKey = configuration.AppSettings.Settings["ComputerKey"].Value;
@@ -122,8 +125,16 @@ private void game_start_timer_Tick(object sender, EventArgs e)
         public void SetConfigValue(string key, string value)
         {
             Configuration configuration = ConfigurationManager.OpenExeConfiguration(ConfigurationUserLevel.None);
+
+            if(key == "Secret")
+            {
+                //string encryptedValue = encryption.Encrypt(value);
+                string encryptedValue = MachineKeyEncryption.Protect(value, "Secret");
+                value = encryptedValue;
+            }
+
             configuration.AppSettings.Settings[key].Value = value;
-            configuration.AppSettings.SectionInformation.ProtectSection(null);
+            //configuration.AppSettings.SectionInformation.ProtectSection(null);
             configuration.Save();
 
             ConfigurationManager.RefreshSection("appSettings");

Server/LauncherClient/LauncherClient.csproj

@@ -66,7 +66,7 @@
     <ApplicationManifest>Properties\app.manifest</ApplicationManifest>
   </PropertyGroup>
   <PropertyGroup>
-    <SignManifests>true</SignManifests>
+    <SignManifests>false</SignManifests>
   </PropertyGroup>
   <ItemGroup>
     <Reference Include="Microsoft.Owin, Version=3.1.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">

Server/LauncherClient/Owin/Controllers/GamesController.cs

@@ -30,7 +30,13 @@ public StatusMessage StartGame(int id, bool install = false)
             string baseURL = ConfigurationManager.AppSettings["BaseURL"];
             string computerKey = ConfigurationManager.AppSettings["ComputerKey"];
             string secretKey = ConfigurationManager.AppSettings["Secret"];
-            encryption = new Encryption(secretKey);
+
+            // We must decrypt the secret key using the machine key
+            //machineKeyEncryption = new Encryption("the machine key");
+            secretKey = MachineKeyEncryption.UnProtect(secretKey, "Secret");
+
+            // Then, we can Encrypt/Decrypt using that decrypted secret key
+            encryption = new Encryption(secretKey); 
 
             string URL = $"{baseURL}/game/checkout/{id}";
             SteamGame game = gc.GetSteamLogin(id, URL, computerKey, "");