.Net 3.5，在进程之间传递字符串的最安全方法
我希望能够将 SecureString （缓存的密码）传递给 C# (.Net 3.5) 中的子进程，但我不知道最安全的方法是什么。 例如，如果我将 SecureString 转换回常规字符串并将其作为命令行参数传递，那么我认为该值可能容易进行磁盘分页 - 这将使明文触及文件系统并破坏使用 SecureString 的意义。
可以改为传递 SecureString 的 IntPtr 吗？ 我可以使用命名管道而不增加风险吗？
I'd like to be able to pass a SecureString (a cached passphrase) to a child process in C# (.Net 3.5), but I don't know what the most secure way is to do it. If I were to convert the SecureString back to a regular string and pass it as a command-line argument, for example, then I think the value may be prone to disk paging--which would make the plaintext touch the filesystem and ruin the point of using SecureString.
Can the IntPtr for the SecureString be passed instead? Could I use a named pipe without increasing the risk?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
一般来说，您应该在担心更奇特的攻击之前定义您的威胁模型。 在这种情况下：您是否担心有人关闭计算机并对硬盘进行取证分析？ 应用程序内存也可以被换出，因此一个进程将其存储在内存中这一简单事实使得它有可能在交换文件中结束。 冬眠怎么办？ 在休眠期间，内存的全部内容都会写入硬盘（包括 SecureString - 可能还包括加密密钥！）。 如果攻击者可以在系统运行时访问系统并且可以搜索应用程序的内存，该怎么办？
一般来说，客户端安全性非常棘手，除非您有专用硬件（如 TPM 芯片），否则几乎不可能做到正确。 两种解决方案是：
In general you should define your threat model before worrying about more exotic attacks. In this case: are you worried that somebody shuts down the computer and does a forensic analysis of the harddrive? Application memory can also be swapped out, so the simple fact that one process has it in memory, makes it potentially possible for it to end in the swap file. What about hibernation? During hibernation the entire content of the memory is written to the harddisk (including the SecureString - and presumably the encryption key!). What if the attacker has access to the system while it's running and can search through the memory of applications?
In general client side security is very tricky and unless you have dedicated hardware (like a TPM chip) it is almost impossible to get right. Two solutions would be:
除非您的子进程也了解如何使用 SecureString，否则我认为没有办法直接传递它。 例如，Process.Start() 方法有两个采用 SecureString 的重载，因此实际字符串值被嗅探的风险被最小化（这仍然是可能的，因为在途中的某个地方必须检索/解组实际值）。
我认为如何做到这一点很大程度上取决于子进程是什么以及它是如何启动的。
Unless your child process also understands how to work with SecureString I don't think there is a way to pass it directly. For example, the Process.Start() method has two overloads that take a SecureString so the risk of the actual string value being sniffed is minimized (it's still possible since somewhere along the the way the actual value has to be retrieved/unmarshalled).
I think a lot of how to do this will depend on what the child process is and how it is being started.