From Wikipedia, the free encyclopedia

This article may require cleanup to meet Wikipedia's quality standards. Please discuss this issue on the talk page or replace this tag with a more specific message. This article has been tagged since March 2007.

DPAPI stands for Data Protection Application Programming Interface. It is a (relatively) simple API available as standard in Microsoft Windows 2000 and up.

For almost all types of encryption, you need a key. A key is a string of characters or bytes that is used to encrypt or decrypt the data. However, when developing secure systems, the question "how do I store the encryption key" often arises. If you store it in "plain text", then anyone that can access the key can access the encrypted data. If you want to encrypt it, it you need a further key, which will also need encrypting, and so on ad infinitum. The DPAPI allows the developer to encrypt keys based on a particular user's profile or all the users of the local machine by the use of the system DPAPI key.

The actual keys (used for encrypting your keys) are stored under "Application Data\Microsoft\Protect\{SID}", where {SID} is the security identifier of that user. The DPAPI key is stored in the same file as the master key that protects the users private keys. It usually is 40 bytes of random data.

DPAPI doesn't store anything, other than its own "master" keys used for encryption and decryption.

DPAPI is a very powerful and cryptographically secure system - provided that the DPAPI key is not compromised. Particular data blobs can be encrypted in a way that Salt (cryptography) is added and/or an external - user provided password is required.

This API is rarely used, since most applications prefer to roll out their own schemes.

Delegated access can be given to keys through the use of a COM+ object. This enables IIS web servers to use the API easily. See [1]

Microsoft information is at: [2] and at [3]