Securing Strings in Memory

home
security
view story

5 Kicks

Securing Strings in Memory(www.beckshome.com)

submitted by thbst16(26) 8 months, 15 days ago

I recently had the opportunity to look into and make use of the Microsoft System.Security.SecureString class. This class is one of those dark corners of the .NET Framework that you don’t think about on a day-to-day basis but are really glad that it’s there when your security auditor starts asking questions about how PII data such as social security numbers are protected while resident in memory. The SecureString class takes care of this problem, helping you avoid a situation where unencrypted sensitive String data is left lingering around on the .NET heap. However, since this class does reference unmanaged memory buffers, its use is not entirely intuitive. I’ve attempted to demystify things with the explanation, drawing and code snippets in this post.

3 comments |category: Security |Views: 33
Tweet

tags: Security another

Everyones tags:

Your Tags:

Please login or signup.

Add a live kick counter to your blog >> liveImage

You can even customize the image by choosing your own colors, and then clicking the button below to update the preview and the html code:

"Kick It" text
"Kick It" background
kick count text
kick count background
border

Simply copy and paste this HTML into your blog post.

Users who kicked this story:

BILE_GRAN_CORREA(0) -

Bile0Gran0Vieira0Correa(0) -

bsenoff(1583) -

dpeterson(4397)

More who kicked this story...

Comments:

posted by dpeterson(4397) 8 months, 14 days ago 0

I've never heard of the SecureString class, and it's unfortunate that that is the case. I think with Microsoft's new outlook on the importance of security, they should be promoting these features and baking them into more of the framework.

I read through the SecureString class docs, as well as the article on DPAPI, and I can't find where it determines what encryption algorithm to use. I would hope that it's using AES, but as a developer I'm curious as to whether the encryption scheme can be chosen? This is important if requirements change and require a higher grade of encryption in the future, or if a vulnerability is found in the encryption mechanism that DPAPI is choosing.

posted by thbst16(26) 8 months, 14 days ago 0

I think DPAPI uses a proprietary MS encryption algorithm, which is never a good thing. I'm not sure what support the native Windows APIs provide for public algorithm-based symmetric-key encryption. This may ultimately be the limiting factor here.

posted by dpeterson(4397) replied to thbst16(26), 8 months, 14 days ago 0

Encryption and proprietary are never good together ;-)
Unfortunately, they've shot themselves in the foot on this feature if that's the case. I'm pretty sure that credit card companies require AES encryption, so this implementation could not be used in that case.

Most Active Users

What's this?