Re: encrypt data in registry

This is a nasty problem, because encrypting the data won't actually protect it from other
than casual inspection; for example, if I knew you had an encrypted password, it would
take me perhaps 20 minutes to get the plaintext (run the app under a debugger, intercept
the RegQueryValueEx call, and single-step through the decode process). Alternatively, I
would intercept the password when it was first typed in, which would probably take me five
minutes to code up.

Rights will not protect the key (they are not that complicated, but they don't actually
protect information, as you observe), because if I'm running as the logged-in user, I
would be able to red the plaintext, which means that any malware that might download would
be able to read it anyway.

You would need a challenge-response system to ensure that you had some hope of security,
and even that can be compromised but it is much harder.

You might investigate the crpyto API (look for CryptoAPI in the MSDN), which will only
give you slightly improved security over plaintext, because of the possibility of a
plaintext intercept.
joe

On Sun, 01 Jul 2007 21:54:23 -0700, Frank Cusack <fcusack@xxxxxxxxxxx> wrote:

Sorry, I realize this is not an MFC question but hopefully you will
tolerate it.

I would like to encrypt some data in the registry. At least I think
I'd like to do that. :-)

I'm storing a secret key. I don't want to depend on access rights
because, well they seem complicated and also I don't want a registry
backup to expose the key.

I want to avoid storing a separate key, used to encrypt the registry
data, because that seems obviously not helpful. That key would
necessarily have to be on the machine and therefore doesn't offer a
lot of protection. Still, that might be ok if it were my only choice.

It's not ok for the user to have to type a password (at app startup)
to unlock the registry data.

So, I thought the ideal would be using the user's password. Is there
some function to either get access to this (or the MD4 of it,
whatever), or to have the system apply the user's password to encrypt
my data? With this idea, I don't actually NEED access to the user's
password, just access to some service that uses the user's password.

The problem with this is that if the user changes their password, the
registry data is now bad. Even if there is a way for my app to be
signalled on password changes, what if my app isn't running at the
time?

So, any ideas? It'd be nice to have a service like the Mac OS X
keychain.

-frank
Joseph M. Newcomer [MVP]
email: newcomer@xxxxxxxxxxxx
Web: http://www.flounder.com
MVP Tips: http://www.flounder.com/mvp_tips.htm
.

Relevant Pages

  • Re: Using the date to allow users to have a grace period
    ... I've used an obscure place in the registry but add to it... ... I encrypt the ... I disable to entire app. ... >> their PC after the 30 days to be within the 30 day trial period, ...
    (microsoft.public.dotnet.framework.windowsforms)
  • encrypt data in registry
    ... I would like to encrypt some data in the registry. ... It's not ok for the user to have to type a password (at app startup) ... The problem with this is that if the user changes their password, ...
    (microsoft.public.vc.mfc)
  • Re: Deploying a WinForm App
    ... When the app is installed, ... Encrypt the processor ID and store the encrypted value in the Registry ... This won't prevent your app being run in virtual environments such as ...
    (microsoft.public.dotnet.languages.csharp)
  • RE: AES Symmetric Key Secure Storage
    ... private key - both stored in a CAPI container. ... Now if you use PER USER AES key than the best is to protect the key (ie. ... encrypt it) with a key pair stored in the user's container. ...
    (microsoft.public.platformsdk.security)
  • RE: Using Win32 CryptDecrypt to Decrypt RijndaelManaged
    ... I figured out how to use RijndaelManaged with AES in the C++ app. ... C++ crypto WILL successfully decrypt the .NET generated ... I am trying to write a Win32 app that can decrypt that string using the ... I can get both to encrypt and decrypt successfully in their own projects, ...
    (microsoft.public.platformsdk.security)