DPAPI (Data Protection Application Programming Interface) is a relatively simple cryptography API available as a standard component in Microsoft Windows 2000 and later versions of Windows operating systems. The German Lorenz cipher machine, used in World War II for encryption of very high-level general staff messages Cryptography (or cryptology; derived from Greek κρυπτός kryptós hidden, and the verb γράφω gráfo write) is the study of message secrecy. ... An application programming interface (API) is a source code interface that a computer system or program library provides to support requests for services to be made of it by a Length. ... Windows 2000 (also referred to as Win2K) is a preemptible, interruptible, graphical and business-oriented operating system that was designed to work with either uniprocessor or symmetric multi-processor 32-bit Intel x86 computers. ... Microsoft Windows is the name of several families of proprietary software operating systems by Microsoft. ...

For almost all types of encryption, a cryptographic key is required. A key is a string of characters or bytes that is used to encrypt or decrypt the data. However, when developing secure systems, the question of how to store the encryption key often arises. If the key is stored in plain text, then any user that can access the key can access the encrypted data. If the key is to be encrypted, another key is needed, and so on ad infinitum. DPAPI allows developers to encrypt keys based on a particular user's profile or all the users of the local machine by the use of the system DPAPI key. “Cipher” redirects here. ... A key is a piece of information that controls the operation of a cryptography algorithm. ... This article refers to the unit of binary information. ...

The actual keys used for encrypting the user's keys are stored under "Application DataMicrosoftProtect{SID}", where {SID} is the security identifier of that user. The DPAPI key is stored in the same file as the master key that protects the users private keys. It usually is 40 bytes of random data. DPAPI doesn't store anything, other than its own "master" keys used for encryption and decryption.

DPAPI is a very powerful and cryptographically secure system, provided that the DPAPI key is not compromised. Particular data binary large objects can be encrypted in a way that Salt is added and/or an external user-provided password is required. A blob is a collection of binary data stored as a single entity in a database management system. ... In cryptography, a salt consists of random bits used as one of the inputs to a key derivation function. ...

Delegated access can be given to keys through the use of a COM+ object. This enables IIS web servers to use the API easily. IIS (Microsoft Internet Information Services or Server) is a set of Internet based services for Windows machines. ... The term web server can mean one of two things: a computer responsible for serving web pages, mostly HTML documents, via the HTTP protocol to clients, mostly web browsers; a software program that is working as a daemon serving web documents. ...

DPAPI, however is rarely used on Windows, since most applications prefer to roll out their own schemes. Internet Explorer versions 4.0-6.0, Outlook Express and MSN Explorer used a Protected Storage (PStore) API to store saved credentials such as passwords etc. Internet Explorer 7 now stores its credentials using the more secure DPAPI. Windows Internet Explorer (formerly Microsoft Internet Explorer), and commonly abbreviated to IE, is a series of proprietary graphical web browsers developed by Microsoft and included as part of the Microsoft Windows line of operating systems starting in 1995. ... For the personal information manager included in the Microsoft Office suite, see Microsoft Outlook. ... Wikipedia on MSN Explorer MSN Explorer is a web browser, developed by Microsoft, which comes with Windows XP that integrates MSN features such as Hotmail and MSN Messenger with a web browser. ... It has been suggested that this article or section be merged with Internet Explorer. ...

External links

• Windows Data Protection API (DPAPI)
• Data encryption with DPAPI
• Use DPAPI to encrypt and decrypt data
• Using DPAPI (User Store) from ASP.NET 1.1 with Enterprise Services

This Microsoft Windows article is a stub. You can help Wikipedia by expanding it.