3 ms·
So why don't these tools use CryptProtectMemory to protect the memory: https://docs.microsoft.com/en-us/windows/desktop/api/dpapi/nf-dpapi-cryptprotectmemory ht
by hsnewman 8y ago
So why don't these tools use CryptProtectMemory to protect the memory: https://docs.microsoft.com/en-us/windows/desktop/api/dpapi/nf-dpapi-cryptprotectmemory https://docs.microsoft.com/en-us/windows/desktop/api/dpapi/n... ?
- Someone1234 8y agoYour own article tells you why: > Using CryptProtectMemory and CryptUnprotectMemory for password encryption is not secure because the data exists as plaintext in memory before it is encrypted and at any time the caller decrypts it for use. In order to benefit from CryptProtectMemory you have to carefully lifecycle strings in and out of secure storage as needed; this wouldn't mitigate some of the issues presented in the article.
- loeg 8y agoC# has a core class to safely lifecycle protected strings. The decryption key is only resident in kernel memory, so a dump of the user process when protected theoretically cannot read the protected string contents. (Of course, this doesn't prevent against a cold boot attack unless the keys are escrowed in a TPM.) https://referencesource.microsoft.com/#mscorlib/system/security/securestring.cs https://referencesource.microsoft.com/#mscorlib/system/secur...