c# - Azure Table Storage Client Side Encryption WITHOUT Using KeyVault -

i've got sensitive information want encrypted , stored in azure table storage. honestly, naive approach, using same aes key values sufficient near approach having enough data encrypted in order meaningful cryptanalysis. but, know best practice limit usage of same symmetric key.

recently, microsoft released client side encryption azure table storage via azure keyvault. allows generate rsa key , store in keyvault , client library generate new symmetric key every row in table storage , encrypts symmetric key rsa key. perfect because there no way differential cryptanalysis on ciphertext since used different keys. nice because library plumbing, have grab rsa key keyvault, decorate designated properties encryptpropertyattribute , handles else.

therein lies rub... find keyvault kind of obtuse use , manage. have use powershell set oauth authentication between app , keyvault , looks tremendous amount of overhead storing single rsa key. if have hundreds of keys store, can imagine more useful.

is there way use of microsoft's client side encryption code without storing rsakey in keyvault?

it took me while find it, yes, can store rsa key outside of keyvault. need use rsakey constructor overload takes in rsacryptoserviceprovider grab wherever deem prudent. grab mine out of web.config. however, make sure production rsacsp not store in source control , add directly in azure web app configuration screen.

ikey tablestoragekey = gettablestoragekey() _tablerequestoptions = new tablerequestoptions {     encryptionpolicy = new tableencryptionpolicy(tablestoragekey, null) };  ...  private ikey gettablestoragekey() {     using (var rsacsp = new rsacryptoserviceprovider(2048))     {         try         {             //it doesn't matter rsacsp from, have mine in webconfig             xmldocument doc = new xmldocument();             doc.load(appdomain.currentdomain.setupinformation.configurationfile);             xmlelement node = doc.selectsinglenode("/configuration/mytablestoragersakey") xmlelement;              rsacsp.fromxmlstring(node.outerxml);              return new rsakey("mytablestoragersakey", rsacsp);         }                 {             rsacsp.persistkeyincsp = false;         }      } }