Encrypting data in DB - where to store the key?

Concerning this article:
http://msdn.microsoft.com/en-us/library/ms998372.aspx#pagpractices0001_sensitivedata

Do you allow for the storing a secured registry key that holds an encrypted encryption key? If not, what's a reliable alternative?

'Use DPAPI to encrypt the symmetric encryption key on each Web server and store it in a secured registry key. Create an ACL to protect the registry key that allows full control for administrators and read only access for your ASP.NET process account.'

thanks,
Justin

 

We don't allow our customers to store data in the registry. I recommend just storing the key in your app's web.config.

If you are talking about protecting your web.config data specifically, then see this KB article: http://kb.discountasp.net/article.aspx?id=10478