Powershell secure string encryption

Question

How is secure string encrypted? I've read that it uses DPAPI, but what if I'm using AsPlainText? Does it still uses DPAPI?

briantist · Accepted Answer · 2015-01-16 19:48:42Z

2

The article you linked to starts its second paragraph with:

The ConvertFrom-SecureString and ConvertTo-SecureString cmdlets, when you don’t use their -Key, -SecureKey, or -AsPlainText switches, use DPAPI to encrypt / decrypt your secret data.

So no, if you use -AsPlainText it is not encrypted and doesn't use DPAPI.

When it is encrypted, the key is specific to the user and computer on which you've done the encryption.

According to the ConvertFrom-SecureString documentation, if you use -Key or -SecureKey, then AES is used. As for how DPAPI encrypts data, have a look at this MSDN article about Windows Data Protection. One of its points says:

It uses proven cryptographic routines, such as the strong Triple-DES algorithm in CBC mode, the strong SHA-1 algorithm, and the PBKDF2 password-based key derivation routine.

edited Jan 16, 2015 at 19:48

answered Jan 16, 2015 at 19:38

briantist

48.3k6 gold badges94 silver badges139 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

GregWringle Over a year ago

Yes, I was wondering how that was done. Is it still 3DES? And what information from the user and computer is obtained?

Collectives™ on Stack Overflow

Powershell secure string encryption

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related