ProtectedData.Unprotect (DPAPI) stops working after password change

Question

Suppose I encrypt data and write it to a file like this:

byte[] encrypted =
    ProtectedData.Protect(plain, null, DataProtectionScope.CurrentUser);
File.WriteAllBytes(filename, encrypted);

Decrypting is as straightforward:

byte[] encrypted = File.ReadAllBytes(filename);
byte[] decrypted =
    ProtectedData.Unprotect(encrypted, null, DataProtectionScope.CurrentUser);

Now when I change my windows password between the calls to Protect and Unprotect, Unprotect will throw an exception. I do want the encrypted data to be linked to my user account, but I also want it to survive password changes.

I guess I have to hand the data over to Windows rather than writing it to my own file, so that Windows can re-encrypt it on password changes. I just can't find the documentation that tells me how. Does anyone know?

Answer 1

How do you change the password? Using the normal procedure and specifying the old password should work with ProtectedData, while setting a new password under computer management wouldn't.