Remember that DATA_BLOB.pbData for the output parameters of the CryptProtectData and CryptUnprotectData functions will point to a block of unmanaged memory that needs to be cleaned up using a call to LocalFree from kernel32. You will of course have to use pinvoke to call LocalFree.

Documentation

[DATA_BLOB] on MSDN

crypt32

2: CryptProtectData

Summary

The CryptProtectData function performs encryption on the data in a DATA_BLOB structure. Typically, only a user with the same logon credential as the encrypter can decrypt the data. In addition, the encryption and decryption usually must be done on the same computer.

ref DATA_BLOB pDataIn,

ref DATA_BLOB pOptionalEntropy,

ref DATA_BLOB pDataOut

ByRef pDataIn As DATA_BLOB, _

ByRef pOptionalEntropy As DATA_BLOB, _

ByRef pDataOut As DATA_BLOB _

DATA_BLOB

Change the DATA_BLOB and CRYPTPROTECT_PROMPTSTRUT from structures to classes. This way you don't have to pass the value types by ref. Both the pOptionalEntropy and the pPromptStruct can be null. If you use structs you have to new empty structs instead of just passing null if you use classes.

3: CryptUnprotectData

Summary

The CryptUnprotectData function decrypts and does an integrity check of the data in a DATA_BLOB structure. Usually, only a user with the same logon credentials as the encrypter can decrypt the data. In addition, the encryption and decryption must be done on the same computer.