This question is directed at the .Net framework, but would hopefully be answered to encompass many languages & frameworks.
Let's assume I have a two methods, one which actually decypts data and one which takes the decypted data and returns it to the user:
private string Decypt_Data(string encryptedText, string EncryptionKey) {
string plainText = "";
using(SomeEncryptionClass myObject = new SomeEncryptionClass()) {
myObject.Key = EncryptionKey; //lets not worry about how we create or store these
myObject.IV = GetIV();
plainText = myObject.DecryptText(encryptedText);
}
return plainText; //REFERENCE 1
}
//specifically this is called from a controller after a POST
private ActionResult Read_Encrypted_Value()
{
string encryptedEncryptionKey = GetDataFromDatabase("keyfield");
string encryptionKey = Decypt_Data(encryptedEncryptionKey, GetKeyFromSomeWhereThisIsUnImportant());
//decrypt data with plainText (ie. plainText is a key.. but this isnt important to the question)
syromg encryptedData = GetDataFromDatabase("datafield");
return View(Decypt_Data(encryptedData, encryptionKey)); //RFERENCE 2
}
Looking at the Decrypt_Data method, encrypted text is passed in and decrypted then the plain text is returned.
The question is... how secure is the value stored in "plainText" (at REFERENCE 1)?
The variable plainText only lasts for the scope of the method... but what then? Does that value remain in memory until the Garbage Collector deals with it? Does it get NULLed or something? Should I do something like at REFERENCE 2, where I do the calculate and return the value together? Should I pass strings in as references, so that the variable returning the value doesnt need to be instantiated?
If the value remains in memory, is it not vulnerable? Can an attacker not read memory and steal the value? (I'm working on the princaple that this value is used to decrypt some other data... so the attacker having direct access to the database does not give him all the data).
The Answer
Thanks a lot everyone for your answers, I found this article: http://web.archive.org/web/20090928112609/http://dotnet.org.za/markn/archive/2008/10/04/handling-passwords.aspx in one of the links from user10008's answer. It pretty much covers everything you need to know + complete code listing.