I've been working on just a fun side project in C++ to practice encryption algorithms and I sort of ran into a bit of a roadblock of sorts. To summarize the project I have a text file of encrypted passwords and sites the passwords are for, the user logs in and the encrypted information is stored into a list. Simple enough. The log in works just fine and is as close to using a hash function as I care to try for as small a project as I'd like this to be. My main problem is this :

When I want to show the user their password, I need to decrypt it. How do I pass the key to the decryption algorithm without having it stored in at least RAM? Because I have a encrypted version of the key stored in the text file as well and relies on the hash being correct for the key to be decrypted. But I don't want the user to enter their information again to get the password after they already logged in. So how should I go about this? Should I save the key once I can decrypt it with the users information? Or should is there some solution that is escaping me? Thanks for any help!

  • I realize this is for fun, but you should try to perform client-side encryption only, at least to get the plaintext passwords. It's safer in general if your servers can't access them. – Marc May 25 '20 at 5:21
  • Any kind parameter passed to a function is going to show up in the call stack in the memory. So if you want to not have your key show up in RAM, then you need to rely on special security hardware. – Limit May 25 '20 at 6:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.