COM Interface Security

From: Joseph Geretz (jgeretz_at_nospam.com)
Date: 01/18/05 

Date: Tue, 18 Jan 2005 15:03:25 -0500

How easy or difficult is it to intercept data values passing between a
client and server via a public COM interface? I've built an encryption
component (using the VB Blowfish sample) as a public class in our utility
library. As with all encryption, the secrecy of the key must be protected.
The key is generated dynamically at run time via an internal algorithm. It
would take reverse assembly to discover the key. I'm not worried about
reverse assembly. If someone can reverse-assemble our code then the game is
over in any case.

I am wondering though about how we submit our private key when we first
instantiate and initialize the cryptor class. (Anyone can instantiate this
class, but unless they know the key, they won't be able to decrypt our
protected ciphertext.) Can information passing through a COM interface be
easily intercepted or would it take a skill at the level of reverse-assembly
in order to do this?

Thanks for your advice.

Joseph Geretz

Relevant Pages

  • COM Interface Security
    ... How easy or difficult is it to intercept data values passing between a ... As with all encryption, the secrecy of the key must be protected. ... Can information passing through a COM interface be ...
    (microsoft.public.vb.com)
  • Re: [SLE] Wireless ... again
    ... encryption key and open my wireless network up everything seems to work ... The whole story from booting to getting the network up ... >Although this was a useful way of starting the wireless interface it didn't ...
    (SuSE)
  • Re: AES Questions From Another Dummy.
    ... gnupg is command line, ... incorporate into your user interface for your users who have no crypto ... this is where your simultaneous backup encryption to your key and the ... and wants to allow selected users to also be able to decrypt it, ...
    (sci.crypt)
  • Re: [RFC][PATCH] inotify 0.10.0
    ... but I think the inotify interface would be cleaner if we ... I don't see how passing directories/files to inotify by fd not filename, ... Yes the current method of passing the name back to user space is ...
    (Linux-Kernel)
  • Re: [RFC][PATCH] inotify 0.10.0
    ... > from the inotify code. ... > I don't see how passing directories/files to inotify by fd not filename, ... > makes providing a writeinterface to inotify any easier. ... Robert seems to have issues with making the userspace ...
    (Linux-Kernel)
Loading