.NET Framework Security

By Sebastian Lange

IN THIS CHAPTER

• Administering Isolated Storage

• Administering Cryptography Settings

The .NET Framework contains two technologies that fall outside the administrative capabilities of the .NET Framework Configuration tool as well as Caspol, but which may occasionally require administrative changes ”Isolated Storage and cryptography. Isolated Storage provides for a safe data and file storage system not requiring direct access to the file system, while the .NET Framework cryptography resources offer easy access for managed code to cryptography algorithms, such as RSA and DSA, as well as XML digital signatures. Administrators can set various parameters for both technologies. In this chapter, you will find the following key points covered:

• Review of the Isolated Storage system

• How to access and use the Isolated Storage administration tool

• Some help in writing your own Isolated Storage administration code against the Isolated Storage API set

• How to effectively use the IsolatedStoragePermission to define the degree of access managed code needed for the Isolated Storage system

• Overview of the cryptography configuration system

• Overview of the default settings for the cryptography configuration system

• Advice on how to change the machine.config file to include new cryptography resource mappings

If you find yourself in one of the following situations, you have come to the right portion of this book:

• A managed application has run out of Isolated Storage space.

• You want to clean out all state persisted by applications not having direct access to the file system (typically applications from the Internet or intranet).

• You want to write your own Isolated Storage administration tool.

• You have acquired a new managed cryptography library replacing part or all of the resources in the .NET Framework and want instantiations of common cryptography algorithms to go through the new library.

• You have written your own cryptography algorithm implementation and want that to be used by default as opposed to an algorithm implementation shipping in the .NET Framework System.Security.Cryptography namespace.

• Your enterprise has purchased a dedicated cryptography device (such as a hardware cryptographic accelerator), and this machine offers access to its services via a managed wrapper. You want the device's wrapper class and not the cryptography algorithm implementation in the .NET Framework's System.Security.Cryptography namespace used by default.

• You are simply curious what the Isolated Storage system and cryptography configuration system are all about.

As you will see, we have left behind the realm of GUI supported administration. However, both the Isolated Storage and cryptography configuration systems are very straightforward, and changes are very tractable and simple to make.