Otdfbt

TL;DR;

In which registry hive does the ASP.NET Core Data protection system
store it's keys when you are running your app in IIS with a worker
process account without user profile

It looks like it's reusing the hive used by ASP.NET DPAPI, is it ?

We are setting up a bunch of asp.net core applications that need to work together and the antiforgery validation is currently messing things up for POST requests.
It looks like ASP.NET core Data protection needs to be configured so that all applications are using the same keys.

All our applications currently run with a pool user for which neither the user profile nor the HKLM registry key ring seems to be available.

We are not allowed to activate the user profile for these pool users so we are looking to use the registry.

In the "Data protection" section of the "Host ASP.NET Core on Windows with IIS" document here we found that to configure data protection under IIS to persist the key ring, one of the approaches is to create Data Protection Registry Keys with a powershell script from github here :

This script is just called like this :

Provision-AutoGenKeys "4.0" "32" $poolSid

Reading this powershell script it seems that all it does is setting ACLs for the pool user on the following keys :

HKEY_LOCAL_MACHINESOFTWAREMicrosoftASP.NET2.0.50727.0AutoGenKeys
HKEY_LOCAL_MACHINESOFTWAREMicrosoftASP.NET4.0.30319.0AutoGenKeys
HKEY_LOCAL_MACHINESOFTWAREWOW6432NodeMicrosoftASP.NET2.0.50727.0AutoGenKeys
HKEY_LOCAL_MACHINESOFTWAREWOW6432NodeMicrosoftASP.NET4.0.30319.0AutoGenKeys

Here is where I'm getting totally confused.... these look like hives for the "old" autogenerated keys for encryption by ASP.NET,
not ASP.NET Core....

So, I'm wondering... is Microsoft reusing those hives for ASP.NET Core Data Protection ?

Or should I look elsewhere ?

ASP.NET Core can store Keys pretty much anywhere:

• File System


• Windows Registry


• IIS User Profile ( can in which keys are persisted to the HKLM registry in a special registry key that is ACLed only to the worker process account. Keys are encrypted at rest using DPAPI)


• Azure KeyVault, Azure Storage Account


• Azure app keys (at %HOME%ASP.NETDataProtection-Keys)


• SQL store


• Redis cache


• User profile (If the user profile is available, keys are at %LOCALAPPDATA%ASP.NETDataProtection-Keys folder and encrypted at rest using DPAPI for Windows)

So you should look at the location corresponding to your case/configuration.