On our Visual Studio 2008 web site, running under .Net 3.5,
We have encrypted our web.config connection strings using the default provider. RsaProtectedConfigurationProvider
The keys were generate on a Windows XP SP2 box (64 bit dual core) - not sure if that's relevant or not.
Main Question: is this encryption method FIPS 140-2 compliant?
Additional details follow:
We used the aspnet_regiis.exe to create the key container.
aspnet_regiis.exe -pc "EEXKeyContainer" ?exp
Creating RSA Key container...
Succeeded!
Our Web.config shows http://www.w3.org/2001/04/xmlenc#rsa-1_5, which equates to
TRIPLEDES, and therefore, we think, FIPS 140 compliant.
<EncryptedData xmlns="http://www.w3.org/2001/04/xmlenc#" ...
Go to the complete details ...