Need a way to store encrypted values in configuration

[Eilon]

System.Web supports encrypted configuration as seen in this MSDN article.

We should consider having some solution to this problem in ASP.NET/EF vNext.

[muratg]

@Eilon do we want this in RC1?

/cc: @GrabYourPitchforks, @danroth27

[Eilon]

@blowdart too.

I don't have any particular opinion on this. I think ultimately it depends on what we want the recommended secret storage to be. For example, there's a school of thought that says to never store any secrets in any config file, regardless of being encrypted.

[GrabYourPitchforks]

Re: the school of thought, this sentiment is true but ignores the complexity of proper secret management. The reason encrypted config is so popular is that it often strikes the appropriate balance between good security and ease of use.

[GrabYourPitchforks]

FYI, the XML config source can essentially get this for free by using the EncryptedXml class. It shouldn't be more than half dozen lines or so.

[davidfowl]

Would that be in core clr as well?

[GrabYourPitchforks]

Not yet, but NetFX knows it's important, so plan for its eventual inclusion. It can be ifdefed to only desktop for now.

[danroth27]

I've had customers asking me about encrypted config support, so I think we should have a story here.

[blowdart]

Yes we want it in RC1.

[GrabYourPitchforks]

PR for this is at #148.