Why is SecureString decryption giving different results between executables?

Question

In proxy.exe I am creating a secure string the following way:

public SecureString GetSecureEncryptionKey()
    {
        string strPassword = "8charPwd";
        SecureString secureStr = new SecureString();
        if (strPassword.Length > 0)
        {
            foreach (var c in strPassword.ToCharArray()) secureStr.AppendChar(c);
        }
        return secureStr;
    }

Then in main.exe I am decrypting it using this function:

public string convertToUNSecureString(SecureString secstrPassword)
    {
        IntPtr unmanagedString = IntPtr.Zero;
        try
        {
            unmanagedString = Marshal.SecureStringToGlobalAllocUnicode(secstrPassword);
            return Marshal.PtrToStringUni(unmanagedString);
        }
        finally
        {
            Marshal.ZeroFreeGlobalAllocUnicode(unmanagedString);
        }
    }

The issue is that the returned string is empty, unless I encrypt the initial string within main.exe, then the returned decrypted string is indeed "8charPwd". Why is this happening? Is SecureString encryption bound to the executable?

Answer 1

The purpose of SecureString is to keep strings safety inside your application memory(keep the string secure in RAM) SecureString object is not a serialize-able. You cannot transfer an instance between applications.

SecureString encrypt the string by using RtlEncryptMemory (WINAPI) with the flag:"0" (only the same process can decrypt the content). RtlEncryptMemory API

if you don't want to expose the password(at any time) in the RAM, you can create a simple obfuscation(or encryption) logic, and then transfer the content.

Edit:

I found 2 old questions that might be helpful for you:

When would I need a SecureString in .NET?

Wcf-Authentication and Logging