1

today, I wanted to dig deeply into the concept of SecureString .NET and Powershell, yet I don't think, I am understanding it very well.

If I have a password and convert it to a securestring. Is it saved as I entered it? (Being both encrypted or plain text).

Now if I would pass the password as a part of a PSCredential to a PSSession: what would happen? Does PSSession run ConvertFrom-SecureString on the passed password? But then the password is being encrypted again. How does it know how to pass it to a PSSesion?

mh133
  • 135
  • 12
  • 1
    did you try google? see: https://social.technet.microsoft.com/wiki/contents/articles/4546.working-with-passwords-secure-strings-and-credentials-in-windows-powershell.aspx – Avshalom Feb 14 '18 at 16:14
  • Thanks @Avshalom. I may didn't explain myself very well. My question was considering the way SecureStrings are being handled internally by a PSSession. Especially the point where they are being decrypted. – mh133 Feb 15 '18 at 08:28

1 Answers1

5

I don't fully understand your question but get the jist. This will probably be easier if you think in terms of object types (some explanation). [This link is now dead.]

"If I have a password and convert it to a securestring. Is it saved as I entered it? (Being both encrypted or plain text)"

  • Your password will be plain text, and have the type [String]. This is not encrypted.
  • The SecureString has the type [System.Security.SecureString]. It is encrypted.
  • This encryption happens in memory whenever you create the SecureString.
  • It's important to note that a key is required to decrypt the SecureString (more on that below)

Approach 1
This creates an encrypted SecureString variable called $SecurePassword. The unencrypted password does not make it to memory.

$SecurePassword = Read-Host -Prompt "Enter password" -AsSecureString

Approach 2
This creates an unencrypted String variable $PlainPassword, then a SecureString variable.

$PlainPassword = Read-Host -Prompt "Enter password"
$SecurePassword = $PlainPassword | ConvertTo-SecureString -AsPlainText -Force

"Now if I would pass the password as a part of a PSCredential to a PSSession: what would happen?"

  • PSSession does not accept unencrypted passwords. To simplify you can either provide a User and be prompted for a password, or pass an object that has the type PSCredential - i.e. it is expecting a secure password.
  • When you a pass a PSCredential, it is already encrypted with the password as a SecureString.
  • But the PSSession needs to decrypt it (this part I am not sure on but assume... how else can it varify it?)
  • To decrypt the SecureString, the key is required. The key is normally generated and as long as both machines have the same security principle, the PSSession can complete the decryption (this part I'm sure of)
  • This post addresses how to create a key so that a SecureString can be decrypted when there there are different principles.
Mike Williamson
  • 4,915
  • 14
  • 67
  • 104
G42
  • 9,791
  • 2
  • 19
  • 34
  • I see. Just to be sure: If a password is being encrypted on `ConvertTo-SecureString`: What does happen on `ConvertFrom-SecureStrin`? Is it just a convertion to a encrypted text, and not a on memory one? This Text needs to be passed to a `PSSession`: Does the Session decrypt it? (To a Hash I guess). Else how would the machine be able to start with an encrypted password? The keys used are located on the machine initiating the `PSSession` call. – mh133 Feb 15 '18 at 08:20
  • @Mahmoud [`ConvertFrom-SecureString`](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/convertfrom-securestring?view=powershell-6) can accept a key, if used to originally encrypt the string. Otherwise it will use [Windows DAPI](https://msdn.microsoft.com/en-us/library/ms995355.aspx). For PSSession, read about the [-Authentication parameter](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/new-pssession?view=powershell-6). – G42 Feb 22 '18 at 21:45
  • @Mahmoud If you've found this answers your questions, please consider [accepting/voting](https://stackoverflow.com/help/someone-answers) – G42 Mar 01 '18 at 13:34