Question

I am wanting to try to tie the CryptUnprotectData windows API function and the .net SecureString together the best way possible. CryptUnprotectData returns a DATA_BLOB structure consisting of an array of bytes and a byte length. In my program this will be a Unicode UTF-16 string. SecureString has a constructor which takes a char* and length params, so I would like to be able to do something like:

SecureString ss = SecureString((char*)textBlob.pbData, textBlob.cbData / 2);

This works, except UTF-16 is variable length, so I don’t really know what to use as the length argument. The above example assumes 2 byte characters (BMP), but for other planes it could be up to 4 bytes. I need to know the number of UTF-16 characters in the byte array. What is the best way to do this without copying the values around in memory (thereby compromising security). I plan on zeroing out and freeing the byte array as quickly as possible.

Answer 1

Most of the Windows API deals with UTF-16 code points as far as I’m aware – in other words, you treat surrogate pairs as two code points instead of a single character. Given that the constructor for SecureString is dealing with a pointer to .NET System.Char values (which are UTF-16) I think the code snippet you’ve got is fine – the number of elements in pbData is half its size in bytes.

For instance if pbData contained (just) a surrogate pair, cbData would be 4 and you’d still want to pass in 2 as the second argument – because that’s the number of System.Char values you’re constructing the SecureString from. The fact that it’s one non-BMP unicode character is irrelevant to the number of UTF-16 System.Char values it’s represented in.

(And yes, the support for non-BMP data is a bit of a mess, and I suspect very few people get it right everywhere. I’m sure I don’t. Fortunately in many places you don’t need to worry…)