Can you set the MachineKey programmatically?

Question

In ASP.NET can you set the machineKey settings programmatically?

The web app that we use stores sensitive info encrypted in a database, so if we could put the decryptionKey there it would be handy.

Answer 1

No; the machineKey element must be set via config. However, web.config can itself be encrypted, which helps minimize risk of cryptographic key disclosure if an attacker ever gets access to the config file. (This same process can be used to protect SQL connection strings and pretty much any other sensitive config element you wish.) See http://msdn.microsoft.com/en-us/library/dtkwfdky(v=VS.100).aspx for a walkthrough on enabling this.

Answer 2

Yes, you can. I got success using this code in ConsoleApplication:

private static void ChangeWebConfig(string validationKey, string decryptionKey, string webConfigPath)
{
    ExeConfigurationFileMap configFileMap = new ExeConfigurationFileMap();
    configFileMap.ExeConfigFilename = webConfigPath;
    System.Configuration.Configuration config = ConfigurationManager.OpenMappedExeConfiguration(configFileMap, ConfigurationUserLevel.None);
    MachineKeySection section = (MachineKeySection)config.GetSection("system.web/machineKey");
    section.ValidationKey = validationKey;
    section.DecryptionKey = decryptionKey;
    config.Save();
}