Is there some sort of secure local storage on Wind

Question

I was thinking of making a small tool. It is not important what the tool will do. The important thing, is that the tool will need to store some sensitive information on the user's HDD. EDIT: The information that will be stored is USER'S information - I'm not trying to protect my own content, that I distribute with the app.

I understand that I need to encrypt this information. But then, where do I safely store the encryption password? It's some sort of an infinite recursion...

So, is there a way, to encrypt information on windows, and have windows securely manage the passwords? When I say windows I mean Windows XP SP2 or later.

I should also note, that users on the same system must not have access to other users information (even when they are both running my application).

I'm looking for both - .NET 2.0 (C#) and native (C/C++) solutions to this problem.

Answer 1

You should consider using DPAPI for this purpose. It will encrypt your data with a special (internal) symmetric key which is on per-user basis. You don't even need to ask for passwords in this case, because different users on the system will have different keys assigned to them.

The downside of it might be that you can't recover the data if the user is deleted/Windows reinstalled (I believe that this is the case, not quite sure though). In that case encrypt the data with a "self-generated" key derived from the password and store the password in registry/file encrypted using DPAPI.