Re: passing username/passwd between two processes securely...

Thanks Jochen!
Now I understand what do you mean:
using p2 public key to encrypt data in P1 so P2 can decrypt it. It
completely resolves the issue with PKC.
The link you gave me for MS password management cannot be used here due to
our specific application becuase we cannot use GUI in P2.

regards,
-John




"Jochen Kalmbach [MVP]" <nospam-Jochen.Kalmbach@xxxxxxxxx> wrote in message
news:%23VC$mCy3FHA.744@xxxxxxxxxxxxxxxxxxxxxxx
> Hi John!
>> Thanks Jochen!
>> p1 ----encrypt data in shared memory---> p2
>> p2 uses private key to decrypt it.
>> however how p2 get the private key?
>
> There is no need to pass a private key to the other process. Only the
> public keys must be exchanged. And this public key can be seen by others,
> they cannot read the decrypted message with this keys.
>
>> In my case we expect the private key is passed from p1.
>
> As I said: No need to pass private keys...
>
>>>If someone can attach to your process, then it also can read the
>>>username/password from your memory. So your problem has nothing to do
>>>with inter-process-communication...
>>
>> Currently we don't consider this kind of attack. I only want to pass data
>> without exposing to the 3rd process. So In my case the data could be
>> clear text as long as it's not accessable in 3rd process. Shared memory
>> problem is every process can open it if name is known.
>
> As I said: This is no problem, beacuse no other programm can read un
> uncrypt your data... (at least not in the next 100 years).
>
> Please read some docu about Public-Key-Crypthographie:
> http://en.wikipedia.org/wiki/Public-key_cryptography
>
>
>> I heard people say using p1 as parent process to launch p2. using windows
>> pipe to restrict every other melicious process to access. Is that
>> possible?
>
> See other reply...
>
> --
> Greetings
> Jochen
>
> My blog about Win32 and .NET
> http://blog.kalmbachnet.de/


.

Relevant Pages

  • Re: Requiring non-empty passphrase.
    ... I would say no. Public keys are not encrypted with passphrases, ... The trick is that this decryption of the private key ... is done on the client side and the server never sees the private key ...
    (SSH)
  • Re: Passing password in ssh
    ... If I create keys without a passphrase, and share the public keys between ... So you have to crack user@A's account, at least to the point of getting the private key. ... The .ssh directory also needs to be set this way. ... But even having a pass phrase does not help if someone uses dumb passwords. ...
    (Fedora)
  • Re: Passing password in ssh
    ... the scenario I described actually happened years ago to someone I ... If I create keys without a passphrase, and share the public keys between ... You do know that you first have to get the private key of the key ... But simply cracking into a user's account who has access to several ...
    (Fedora)
  • Re: Changing keys
    ... passphrase and change it on my private key at the same time I change ... and public keys stolen by various means including setups where people put ... them on NFS shares, improperly secured boxes, etc.. ... doing this in a really secure environment. ...
    (comp.security.ssh)
  • Re: passing username/passwd between two processes securely...
    ... p2 uses private key to decrypt it. ... public keys must be exchanged. ... Shared memory problem is every process can open it if name is known. ...
    (microsoft.public.win32.programmer.kernel)
Loading