1

I would like to create a variable, a secure one, that is more or less a CONST to use in my code. I've looked into using System.Security.SecureString, and that looks like it could be the ticket as I don't want the user to find out this password. The only problem comes with initializing it. In most cases, it looks like the SecureString is best "set" by user keypress. I don't want this. One option I've come accross looks like this:

unsafe public static void Main()
   {
      SecureString testString;
      // Define the string value to assign to a new secure string.
      char[] chars = { 't', 'e', 's', 't' };

      // Instantiate a new secure string.
      fixed(char* pChars = chars)
      {
         testString = new SecureString(pChars, chars.Length);
      }
      // Display secure string length.
      Console.WriteLine("The length of the string is {0} characters.", 
                        testString.Length);
   }

Only problem is, the char array 't','e','s','t' is probably still packed together in memory after a compile. Is there any good way to set the value of a SecureString to a constant value before compile time and have that value be scrambled?

Nick
  • 2,913
  • 12
  • 40
  • 52
  • 1
    What are you trying to accomplish? You want to store a 'secret' password to hide some functionality? The moment the code is leaked/discovered, you're 'security' is gone! A better solution, but still not great, is to have your app. phone home. – Paul van Brenk Jul 29 '09 at 22:27
  • The (source) code doesn't have to be leaked, just distribution of the executable would be enough! Decompiling might be enough... or running it through a debugger. A secret that you send to an untrusted person is no longer secret. – Kitsune Jul 29 '09 at 22:33
  • The root of this is that I have to write out a x509certificate2 to file, and password protect it. I then read it back in using the same password. – Nick Jul 29 '09 at 22:48
  • Do you mean you have to write the private key to a file and password protect it? You should never have to encrypt the public key encapsulated in the certificate because it is, well, public and available for anyone to use. – David Smith Aug 04 '09 at 22:54

1 Answers1

0

You could set every entry in chars to some strongly random value to remove the value from dynamic memory. The string will still be there in the executable, though.

Steve Gilham
  • 11,237
  • 3
  • 31
  • 37