DPAPI entropy tip and importance of obfuscation

Have you ever wondered why CryptProtectData function asks for "Optional Entropy"?

Entropy in crypto world is defined as "randomness". Though is quite difficult for a computer to generate true random value, in this context of DPAPI one can choose a random string oneself and use it in the CryptProtectData function.
Though the official definition of CryptProtectData funtion says its optional value and one can provide NULL to the function, it has its own security value.
Consider this:
You application encrypts the data using "user store" and you do NOT provide entropy to CryptProtectData function.
What if some other application (malware?) running under same credential decrypts the data? What is stopping a malware to do it?
It's actually the entropy. Always use a strong, hard to guess entropy to prevent other applications sneaking at your data.

Now the fun begins.

What is stopping a malware to use reflection to get the entropy value?
The answer is obfuscation. It makes it hard for other applications to look at entropy value and thereby protecting the data encrypted using DPAPI.

Moral of the story:

1. Always provide entropy to CryptProtectData when using user store to encrypt the data. Do not supply NULL
2. Use obfuscation

Happy secure coding, 
Gaurav

Comment Notification

If you would like to receive an email when updates are made to this post, please register here

Subscribe to this post's comments using RSS