.Net 3.5, the most secure way to transfer a string between processes

Question

I would like to pass SecureString (cached passphrase) to a child process in C # (.Net 3.5), but I don't know which is the safest way to do this. If I were to convert SecureString back to a regular string and pass it as a command line argument, then I think that this value can be paged on disk, which will make plain text touch the file system and destroy the SecureString usage point.

Can I pass IntPtr to SecureString? Can I use a named pipe without increasing the risk?

Answer 1

In general, you should define your threat model before worrying about more exotic attacks. In this case: are you worried that someone is shutting down the computer and conducting a forensic analysis of the hard drive? Application memory can also be replaced, so the simple fact that one process has it in memory makes it possible to terminate it in the page file. How about hibernation? During sleep mode, all memory contents are written to the hard drive (including SecureString - and, presumably, the encryption key!). What should I do if an attacker has access to the system during operation and can search the application memory?

In general, client-side security is very complex, and if you do not have specialized equipment (for example, a TPM chip), it is almost impossible to obtain the right. Two solutions:

• If you only need to check the equality between the two lines (i.e. this line is the same as mine before), save only the hash value (salted).
• Forcing the user to re-enter information when it is needed a second time (not very convenient, but safety and convenience are opposite to each other).

Answer 2

If your child process also does not understand how to work with SecureString, I don’t think there is a way to pass it directly. For example, the Process.Start () method has two overloads that SecureString takes, so the risk that the actual string value is sniffed is minimized (this is still possible, since somewhere along the way the actual value needs to be extracted / not reinforced).

I think that a lot of how to do this will depend on what the child process is and how it starts.