ProtectSection with RsaProtectedConfigurationProvider where does the Key go?

I am using System.Configuration to encrypt and protect some passwords in a custom configuration section vis:-.

static public void SetPassAndProtectSection(string newPassword)
{

    // Get the current configuration file.
    System.Configuration.Configuration config =
        ConfigurationManager.OpenExeConfiguration(
        ConfigurationUserLevel.None);


    // Get the section.
    MyAppProtectedSection section = 
        (MyAppProtectedSection)config.GetSection(DEFAULT_SECTION_NAME);

    section.DBPassword = newPassword;

    // Protect (encrypt)the section.
    section.SectionInformation.ProtectSection("RsaProtectedConfigurationProvider");

    // Save the encrypted section.
    section.SectionInformation.ForceSave = true;

    config.Save(ConfigurationSaveMode.Full);
}

This appears to work fine but I need some extra information for my documentation.

Where is the Key stored?

How long is the Key?