Question

According to MSDN SecureString contents is encrypted for additional safety so that if the program is swapped to disk the string contents can’t be sniffed.

How is such encryption possible I wonder? The algorithm would be fixed and therefore either well-known or deductible (say one of seven widely used in industry algorithms) and there must be a key somewhere in the program. So the attacker could fetch the encrypted string, fetch the key and decrypt the data.

How can such encryption be useful?

Answer 1

I’m quoting from an article about the DPAPI which is used to derive the key. This should answer most questions that you have about SecureString.

And yes, SecureString has drawbacks and is not completely secure, there are ways to access to data, for example, injecting Hawkeye into the process is mentioned on MSDN as a way to extract the SecureString. I have not personally verifed this assertation.

DAPI Key Management

DAPI is a symmetric based encryption technique, which means it uses the same key to both encrypt and decrypt data. Before getting to some examples of how to use DAPI it’s worth covering how DAPI manages its key. For the most part DAPI key management process is invisble and you generally don’t need to worry about it, which is the main reason why DAPI is a good approach.

In the introduction I wrote that the master key is generated from the user’s login password. This isn’t the complete picture. What actually happens is Windows uses the user’s login password to generate a master key. This master key is protected using the user’s password and then stored along with the user’s profile. This master key then gets used to derive a number of other keys and it’s these other keys that are used to protect the data.

The reason why Windows does this is it allows applications to add additional information, called entropy, to the process of generating the individul keys. You see if every application running under the user’s login account used the same key then every application could unprotect DAPI protected data. Sometimes you might want applications to be able to share DAPI protected data; however, sometimes you won’t. By letting the application contribute entropy to the generation of a key then that key becomes application specific and any data that is protected by that application can only be unprotected again if they know the entropy.

Although generating a master key, and then using that master key to generate other keys to do the actual encryption, might seem like a long winded approach it does have one major advantage. Since there is an additional level of abstraction between the user password protected master key and the actual keys used to protect the data it means that when the user changes their password then only the master key need to be re-protected; none of the protected data needs to be re-protected. Since the master key is much smaller in size than the data then a significant performance saving is made.

When the user’s password changes then of course a new master key is generated. This new master key is then used to generate new individual keys. However, since all the previously generated individual keys were derived from the old master key then Windows needs to store all previous master keys, which it does. Windows never forgets a master key and all protected data is marked with a GUID that indicates which master key was used to protect the data. So in terms of adaptability DAPI is able to cope with changes to users’ passwords, while ensuring a) that protected data doesn’t need to be re-protected, and b) that keys used to previously protect data as still available, and c) it does all this automatically for you.

Unless the computer is a member of a domain DAPI can only unprotected data on the same machine that was used to protect it.

As well as allowing user level protection, in that master keys are based on user passwords and protected data for one user cannot be unprotected by another user, DAPI also provides machine level protection, in that the master keys are based on machine specific information. Machine level master keys allow applications to store protected data so that it can be unprotected by all users of the application. The only difference in the process already described is the master key is generated from machine specific information not user specific information.