Securing encryption keys in C#

I am aware of the many cryptography providers that are available in the .NET framework along with the basics of how to use them. This is simple enough.

But my concern is this.

Lets say I want to use these libraries to encrypt XML serialized objects to prevent tampering and the ability of anyone to come along and view the contents of these files.

The problem that I am always left with is that the key to decrypt this data would need to be stored as a constant somewhere in my application. Essentially rendering the entire exercise pointless.

So, how does one store a key for an encryption algorithm securely inside of a disassemblable application?

EDIT: So If I am understanding both answers below correctly. What this means is that essentially any implementation (to be secure) requires it to be readonly or writeonly but never both? Is this correct?

10
задан Maxim Gershkovich 11 March 2011 в 02:09
поделиться