This is what the sections look like:
DEK-Info: DES-EDE3-CBC,F5B0591EE16378FB
DLDciEZy4qZFZf5Zd5q7HxXuNKgf3ODED+n6pOO6Uk7vdHP9t3ua3uNZiWoAPwqs
MrghIYtDQqz0GpZzHY0OJLbSUGIYPM12CQKovdF5ZNSdpIiW9mKIn9fFdnFPWICk
25uA1QXrq0nVIn7GWHrON6Y67RvAmP+u7vj5muOLpvqdIyQvlJp1nY2Q4YCBEfIx
T4I1fSrxiCT/RQ/ULd0PHyHUonZvy+6ATutE3QDaYEQVo6dwKIZinBzoA++F8w+X
6iERs/mIUW8KBKyj4uJpMTzh1XigrYaDcFWVjgtd9p+EidXyk3izJmijMa3PC57Q
cqcs7D513XEdejOyR+k2r1CPRBMozRjYmfaPRC/D0YuN0moVQPD6b+xthrQsUwLc
+zIHa8vX3Bh9diisNlJVW9ZaG/9ELXoqp19NCI4qQPFEruSR9PZ3VecydH1IggxP
SmAoYl0Trwbu1YYlR8Md7ZFhHhgmO/5/k7rC0fuacl9lNi4CUUW4adMmukeIccAe
MkXfxSoPWUVr/ULKWQ9SpUuVGWfeDCpY4ywmEblVgnHsTW69gvvWxGuNv6z4ampR
IS5JPz53n4w2IhZqR4J4mm1UiaYtKYzdwURCiG3tcD3PUTsewkkx98A/fNbhQ3HF
qXatgzf5n3UnFmeSHfZhyNXb+Q+vv+OjjEtyuMiii5k9hLEDD0JuV5k0AoPcxv/h
211HfIVWNlNsCqBI3eymw8BZyvelEtC3TSB/AmDj0QEdPRQs+8d3v9ZJHKSiJmeK
svQeboRXAM75Zq65lYMBIJeEw0DM1zq6nqkxLpr0+0k=
-----END RSA PRIVATE KEY-----"
From what I see each line is viewed as a separately changed line in NCM. Meaning its not viewing this entire section as one line.
So I wrote the following Comparison Criteria exclusions:
^DEK.*
^\S\S\S\S\S\S\S\S\S\S\S\S\S\S\S\S\S\S\S\S\S\S\S\S\S\S\S\S\S\S\S\S\S\S\S\S\S\S\S\S.*
This should have excluded any lines that start with DEK as well as any line in configurations that start with 40 or more non-whitespace characters. However every time I back up the device it reports all the sections that start with DEK-Info line have changed.