Storing Secrets

Chapter 7

Storing Secrets

Storing secret information such as encryption keys, passwords, and challenge information used for challenge-response authentication systems in software in a completely secure fashion is impossible. Someone with an account of enough privilege on your computer can easily access the data. Storing secret information securely in software is also hard to do, and thus it s generally discouraged. Sometimes, however, you must, so this chapter will aid you in doing so. The trick is to raise the security bar high enough to make it very difficult for anyone other than appropriate users to access the secret data. To that end, this chapter will cover the following: attack methods; determining whether you need to store a secret; getting the secret from the user; storing secrets in Windows 2000, Windows XP, Windows NT 4.0, Windows 95, Windows 98, Windows Me, and Windows CE; raising the security bar; and using devices to encrypt secret data.

	Keep secret data secret. As a colleague once said to me, the value of a secret is inversely proportional to its accessibility. Put another way: a secret shared by many people is no longer a secret.