Search code examples
c#securityappendsecurestring

How to Append SecureString to SecureString in a secure way

How do i Append multiple SecureStrings?

because i cant do

SecureString pepper 
SecureString salt
SecureString pepperAndSalt = pepper + salt;

and if i would use
SecureString.AppendChar(Char)
i would have to convert salt into a insecure char array which is something i would like to avoid.

Solution

  • You can't1, by definition:

    Note that SecureString has no members that inspect, compare, or convert the value of a SecureString. The absence of such members helps protect the value of the instance from accidental or malicious exposure. Use appropriate members of the System.Runtime.InteropServices.Marshal class, such as the SecureStringToBSTR method, to manipulate the value of a SecureString object.

    Once you get a value in, you can't take it out.

    1: Unless you're willing to start using unmanaged code by using Marshal.SecureStringToBSTR, but that would defy the usage of SecureString…