1. What’s New in Visual Studio 2005: Security &.NET Framework 2.0 Mike Pelton mpelton@microsoft.com Developer & Platform Group Microsoft Ltd.

2. Where Are We Going? Security Securing strings Security Context Access Control Encryption Encrypting XML Framework & Language Enhancements GenericsIterators Edit and Continue Console enhancements

3. Securing Strings The Problem: Managed strings can lurk in your address space: Can’t be erased Old memory isn’t zero’d Garbage Collection… Doesn’t guarantee to overwrite May move them around in the managed heap It could be a long time till heap compaction! System.Security

4. Enter SecureString Stores Data using the Data Protection API Data is always encrypted Encryption key Local Security Authority Subsystem (LSASS.exe) Data can be decrypted Interprocess communication via DPAPI Marshalled by unmanaged code Can be zero’d! System.Security

5. SecureString Demo With thanks to Kit George and GotDotNetGotDotNet

6. Code Access Security New evidence type “Did you come from the GAC?” New permissions to control the new capabilities E.g. SmtpPermission for System.Net.Mail DataProtectionPermission Not everyone should be allowed to decrypt! New extensibility points in the stack Allow permissions to override the handling of demands

7. Impersonation Across Threads SecurityContext The Problem: It doesn’t happen today! SecurityContext carries security context from one thread to another, automatically Deals with managed calls… Thread.Start Worker thread via asynchronous delegate QueueUserWorkItem …but not unmanaged Win32 CreateThead Includes Code Access Security markers E.g. Assert, PermitOnly System.Security

8. Carrying Security Context Between Threads Demo

9. Security Identifiers (SID’s) Uniquely identify user and group accounts Conceptually similar to a GUID Unique in space and time Machine ID + an increasing counter But very different Predictable structure “S” Binary format revision 48-bit Identifier authority (typically 5!) 32-bit Sub-authorities E.g. BUILTIN domain S-1-5-32-547 = “Power Users” Variable Length - challenging to program

10. Security Identifiers Providing broad support for Windows security programming interface Concrete classes: SecurityIdentifier …the machine readable SID NTAccount …the human readable equivalent Abstract class: IdentityReference Binds the two together New enumeration – WellKnownSidType Avoids hard-coding “Administrators” System.Security.Principal

11. Security Identifiers Demo

12. Access Control A very common requirement Settings are manipulated via the Windows SDK Access Control Entries, Lists, Security Descriptors… Not the easiest dev task Discretionary Access Control List issue: Set NULL – everyone gets access Set empty – no-one gets access Programming in.NET 1.1 required the use of platform invocation Huge step forward for.NET 2.0 System.Security.AccessControl namespace

13. Access to an Existing File See Mark Pustilnik’s MSDN ArticleMSDN Article

14. The Hierarchy Access rules are explicit or inherited Explicit rules are added to an object… explicitly Inherited rules come from a parent container Explicit rules for a container: Two sets of flags Inheritance Container inherit (i.e. apply to child containers) Object inherit (i.e. apply to leaf objects) Propagation Inherit only (i.e. just the children, not the object) No-propagate inherit (i.e. children but not grandchildren!)

15. Hiding from the Parents Access Control Protection “The security settings of my parent won’t apply to me any more” “I’ll take the settings my parent has now but ignore any new ones it gets” “I don’t want any of my parent’s settings”

16. System Access Control Lists So much for DACL’s – what about SACL’s? These control what auditing the system will perform on an object Audits can only be generated by the Local Security Authority The only object allowed to write entries into the security event log Audits are for use in computer forensics Who did what when? Try asking for privilege to set them Try asking for privilege to set them

17. Same Familiar Programming Model

18. And Security Descriptors? Traditional cornerstone of Windows security Bundle of Owner SID, Group SID, DACL, SACL & Flags New security rules and objects obviate the need for traditional security descriptors Phew Security descriptors and their ACL’s and ACE’s are still there Entire and complex class library… …but nevertheless much simplified

19. Persisting Security Settings Security Descriptor Definition Language Copying settings between objects Persisting to XML Binary and textual forms “Quasi Human readable” D:P(A;;GA;;;SY)(A;;GRGWGX;;;BA)(A;;GR;;;WD)(A;;GR;;;RC) D:P(A;;GA;;;SY)(A;;GRGWGX;;;BA)(A;;GR;;;WD)(A;;GR;;;RC)

20. Authentication Progamming against authentication protocols was hard! Security Support Provider Interface Secure Sockets Layer New managed wrappers Easily implement client and server-side secure channels KerberosNegotiateStreamSSL Push and pull encrypted, integrity-protected data System.Net.Security

21. Cryptography Hash Functions One-way hash functions exhibit two properties: They’re one way: Easy to take a message and compute the hash value Impossible to take a hash value and recreate the original message. i.e. can't be done in any “reasonable” amount of time They’re collision free They’re collision free Impossible to find two messages that hash to the same hash value

22. Cryptography “SHA-1 is Broken” - Feb 28 th 2005 Feb 28 th 2005Feb 28 th 2005 Three Chinese cryptographers have shown that SHA-1 isn’t collision-free: With SHA-1 every message hashes down to a 160-bit number An infinite number of messages hash to each possible value, so there’s an infinite number of possible collisions The number of possible hashes is huge - the odds of finding a collision by chance is negligibly small (one in 2 80 ) Hash 2 80 random messages, and one pair will hash to the same value "Breaking" a hash function means being able to find collisions faster than the brute force approach The Chinese team can find collisions in SHA-1 in 2 69 calculations - 2,000 times faster than brute force. On the far edge of feasibility with current technology Don’t panic!! There are alternative algorithms! SHA-224, SHA-256, SHA-384, and SHA-512

23. Prefixes YottaY10 24 ZettaZ10 21 ExaE10 18 PetaP10 15 TeraT10 12 GigaG10 9 MegaM10 6 Kilok10 3

24. Cryptography New classes deriving from HMAC System.Security.Cryptography.HMAC “Keyed-hash message authentication code” Covers many Secure Hash Algorithm variants Data Protection API is a first class citizen ProtectedData & ProtectedMemory More help with “salting and stretching” passwords Public Key Cryptography Standards #5 New Rfc2898DeriveBytes function Password-based key derivation functionality System.Security.Cryptography

25. “Stretching” Passwords Public Key Cryptography Standards #5 Password-Based Key Derivation Function 2 Take the master password and a salt value Use that as the seed to a cryptographic random number generator E.g SHA-256 Repeat a few times (say 2 18 !) Why? 94 characters, 12 letter password = 94 12 options Each “guess” now requires 2 18 extra steps The password is effectively stretched by 18 bits 94 12 * 2 18 is roughly 2 97

26. Password Minder Avoids using IE’s password store Requires one strong password Automatically creates and remembers passwords for each site you register at Generated passwords are long, unique, and random Avoids deriving all the passwords from one master string N.B. Full credit is due to Keith Brown’s MSDN Column!MSDN Column

27. Password Minder Demo With thanks to Keith Brown & his MSDN ColumnMSDN Column

28. Encrypting XML MSDN Article MSDN Article “Exchange Data More Securely with XML Signatures and Encryption” Mike Downen, Shawn Farkas W3C Standard “XML Encryption” New EncryptedXML class Flexible Different XML nodes can have different keys “Super Encryption” The encrypted results can be encrypted System.Security.Cryptography.XML

29. EncryptedData Class EncryptionMethod Which algorithm was used Specified by a URI Can be used for data or keys (see over) KeyInfo What key should I use to decrypt? Referenced by: Name An EncryptedData instance CipherData/CipherReference Either the encrypted data, or A pointer to it Isn’t that dangerous?

30. Keys or Data? URI Properties of EncryptedXml Class Encrypting Data Encrypting Keys AESXmlEncAES256Url  XmlEncAES256KeyWrapUrl  DESXmlEncDESUrl  TripleDESXmlEncTripleDESUrl  XmlEncTripleDESKeyWrapUrl  RSAXmlEncRSA1_5Url 

31. Encrypting XML Demo Mike Downen & Shawn Farkas’ MSDNarticle With thanks to Mike Downen & Shawn Farkas’ MSDN articlearticle

32. Encrypting Config Files Encode all or part of web.config easily Decryption is behind-the-scenes Two algorithms: Data Protection and RSA For web farms: Use the RSA provider that relies on a CAPI container DPAPI is machine-specific Allows the encryption key to be synchronised across the entire farm – creates the same config file. System.Web

33. Encrypting Sections of Web.Config Demo

34. Securing Web.Config void ButtonEncryptClick(object sender, EventArgs e) { Configuration config = WebConfiguration.GetWebConfiguration(Request.ApplicationPath); ConfigurationSection section = config.Sections["connectionStrings"]; // Encryption section.ProtectSection("DataProtectionConfigurationProvider"); config.Update();} void ButtonDecryptClick(object sender, EventArgs e) { Configuration config = WebConfiguration.GetWebConfiguration(Request.ApplicationPath); ConfigurationSection section = config.Sections["connectionStrings"]; // Decryption section.UnProtectSection();config.Update();}

35. Security References Practical Cryptography Niels Ferguson & Bruce Schneier Publisher: John Wiley & Sons Inc ISBN: 0471223573 The.NET Developer's Guide to Windows Security Keith Brown Publisher: Addison Wesley Publisher: Addison Wesley ISBN: 0321228359 ISBN: 0321228359

36. What’s New in Visual Studio 2005: Framework & Language Changes

37. An Introduction to Generics Demo

38. public class List { private object[] elements; private object[] elements; private int count; private int count; public void Add(object element) { public void Add(object element) { if (count == elements.Length) Resize(count * 2); if (count == elements.Length) Resize(count * 2); elements[count++] = element; elements[count++] = element; } public object this[int index] { public object this[int index] { get { return elements[index]; } get { return elements[index]; } set { elements[index] = value; } set { elements[index] = value; } } public int Count { public int Count { get { return count; } get { return count; } }} Generics public class List public class List { private T[] elements; private T[] elements; private int count; private int count; public void Add(T element) { public void Add(T element) { if (count == elements.Length) Resize(count * 2); if (count == elements.Length) Resize(count * 2); elements[count++] = element; elements[count++] = element; } public T this[int index] { public T this[int index] { get { return elements[index]; } get { return elements[index]; } set { elements[index] = value; } set { elements[index] = value; } } public int Count { public int Count { get { return count; } get { return count; } }} List intList = new List(); intList.Add(1);intList.Add(2);intList.Add("Three"); int i = (int)intList[0]; List intList = new List(); intList.Add(1); // Argument is boxed intList.Add(2); // Argument is boxed intList.Add("Three"); // Should be an error int i = (int)intList[0]; // Cast required List intList = new List (); intList.Add(1); // No boxing intList.Add(2); // No boxing intList.Add("Three"); // Compile-time error int i = intList[0]; // No cast required

39. Public Class List Private elements() As Object Private elements() As Object Private mCount As Integer Private mCount As Integer Public Sub Add(element As Object) Public Sub Add(element As Object) If (mCount = elements.Length) Then _ If (mCount = elements.Length) Then _ Resize(mCount * 2) Resize(mCount * 2) mCount += 1 mCount += 1 elements(mCount) = element elements(mCount) = element End Sub End Sub Default Public Property i(index As Integer) As Object Default Public Property i(index As Integer) As Object Get Get Return elements(index) Return elements(index) End Get End Get Set Set elements(index) = value elements(index) = value End Set End Set End Property End Property Public Property Count() As Integer Public Property Count() As Integer Get : Return mCount : End Get Get : Return mCount : End Get End Property End Property End Class List intList = new List() intList.Add(1) ‘ Argument is boxed intList.Add(2) ‘ Argument is boxed intList.Add("Three") ‘ Should be an error int i = CInt(intList(0)) ‘ Cast required Generics Public Class List(Of ItemType) Private elements() As ItemType Private elements() As ItemType Private count As Integer Private count As Integer Public Sub Add(element As ItemType) Public Sub Add(element As ItemType) If (count = elements.Length) Then _ If (count = elements.Length) Then _ Resize(count * 2) Resize(count * 2) count += 1 count += 1 elements(count) = element elements(count) = element End Sub End Sub Public Property default(index As Integer) As ItemType Public Property default(index As Integer) As ItemType Get : Return elements(index) : End Get Get : Return elements(index) : End Get Set : elements(index) = value : End Set Set : elements(index) = value : End Set End Property End Property Public Property Count As Integer Public Property Count As Integer Get : Return count : End Get Get : Return count : End Get End Property End Property End Class Dim intList As New List intList.Add(1)intList.Add(2)intList.Add("Three") Dim i As Integer = intList(0) Dim intList As New List(Of Integer) intList.Add(1) ‘ No boxing intList.Add(2) ‘ No boxing intList.Add("Three") ‘ Compile-time error int i = intList(0) ‘ No cast required

40. Generics Why generics? Type checking, no boxing, no downcasts Reduced code bloat (typed collections) How are C# generics implemented? Instantiated at run-time, not compile-time Checked at declaration, not instantiation Work for both reference and value types Complete run-time type information

41. Generics Type parameters can be applied to Class, struct, interface, delegate types class Dictionary {...} struct HashBucket {...} interface IComparer {...} delegate R Function (A arg); Dictionary customerLookupTable; Dictionary > orderLookupTable; Dictionary wordCount;

42. Generics Type parameters can be applied to Class, struct, interface, delegate types Methods class Utils { public static T[] CreateArray (int size) { public static T[] CreateArray (int size) { return new T[size]; return new T[size]; } public static void SortArray (T[] array) { public static void SortArray (T[] array) {...... }} string[] names = Utils.CreateArray (10); names[0] = "Jones";...Utils.SortArray(names);

43. Generics Type parameters can be applied to Class, struct, interface, delegate types Methods Type parameters can have constraints class Dictionary class Dictionary { public void Add(K key, V value) { public void Add(K key, V value) {...... if (((IComparable)key).CompareTo(x) == 0) {...} if (((IComparable)key).CompareTo(x) == 0) {...}...... }} class Dictionary where K: IComparable { public void Add(K key, V value) { public void Add(K key, V value) {...... if (key.CompareTo(x) == 0) {...} if (key.CompareTo(x) == 0) {...}...... }} class Dictionary : IDictionary class Dictionary : IDictionary where K: IComparable where K: IComparable where V: IKeyProvider, IPersistable, new() where V: IKeyProvider, IPersistable, new() { public void Add(K key, V value) {...... }}

44. Generics Zero or one primary constraint Actual class, class, or struct Zero or more secondary constraints Interface or type parameter Zero or one constructor constraint new() class Link where T: class {...} class Nullable where T: struct {...} class Relation where T: class where U: T {...}

45. Generics Collection classes Collection interfaces Collection base classes Utility classes Reflection List<T>Dictionary<K,V>SortedDictionary<K,V>Stack<T>Queue<T> IList<T>IDictionary<K,V>ICollection<T>IEnumerable<T>IEnumerator<T>IComparable<T>IComparer<T> Collection<T>KeyedCollection<T>ReadOnlyCollection<T> Nullable<T>EventHandler<T>Comparer<T>

46. Generics Performance Demo With thanks to Kit George and GotDotNetGotDotNet

47. Iterators foreach relies on “enumerator pattern” GetEnumerator() method foreach makes enumerating easy But enumerators are hard to write! foreach (object obj in list) { DoSomething(obj); DoSomething(obj);} Enumerator e = list.GetEnumerator(); while (e.MoveNext()) { object obj = e.Current; object obj = e.Current; DoSomething(obj); DoSomething(obj);}

48. Iterators public class List { internal object[] elements; internal object[] elements; internal int count; internal int count; public IEnumerator GetEnumerator() { return new ListEnumerator(this); public IEnumerator GetEnumerator() { return new ListEnumerator(this); }} public class ListEnumerator : IEnumerator { List list; List list; int index; int index; internal ListEnumerator(List list) { internal ListEnumerator(List list) { this.list = list; this.list = list; index = -1; index = -1; } public bool MoveNext() { public bool MoveNext() { int i = index + 1; int i = index + 1; if (i >= list.count) return false; if (i >= list.count) return false; index = i; index = i; return true; return true; } public object Current { public object Current { get { return list.elements[index]; } get { return list.elements[index]; } }} public class List { internal object[] elements; internal object[] elements; internal int count; internal int count; public IEnumerator GetEnumerator() { for (int i = 0; i < count; i++) { public IEnumerator GetEnumerator() { for (int i = 0; i < count; i++) { yield return elements[i]; yield return elements[i]; } }}

49. public class Test { public IEnumerator GetEnumerator() { public IEnumerator GetEnumerator() { yield return "Hello"; yield return "World"; yield return "Hello"; yield return "World"; }} Iterators Method that incrementally computes and returns a sequence of values yield return and yield break Must return IEnumerator or IEnumerable public IEnumerator GetEnumerator() { return new __Enumerator(this); return new __Enumerator(this);} private class __Enumerator : IEnumerator { object current; object current; int state; int state; public bool MoveNext() { public bool MoveNext() { switch (state) { switch (state) { case 0: case 0: current = "Hello"; current = "Hello"; state = 1; state = 1; return true; return true; case 1: case 1: current = "World"; current = "World"; state = 2; state = 2; return true; default: return true; default: return false; return false; } } public object Current { public object Current { get { return current; } get { return current; } }}

50. public class List public class List { public IEnumerator GetEnumerator() { public IEnumerator GetEnumerator() { for (int i = 0; i < count; i++) for (int i = 0; i < count; i++) yield return elements[i]; yield return elements[i]; } public IEnumerable Descending() { public IEnumerable Descending() { for (int i = count - 1; i >= 0; i--) for (int i = count - 1; i >= 0; i--) yield return elements[i]; yield return elements[i]; } public IEnumerable Subrange(int index, int n) { public IEnumerable Subrange(int index, int n) { for (int i = 0; i < n; i++) for (int i = 0; i < n; i++) yield return elements[index + i]; yield return elements[index + i]; }} Iterators List items = GetItemList(); foreach (Item x in items) {...} foreach (Item x in items.Descending()) {...} foreach (Item x in Items.Subrange(10, 20)) {...}

51. Iterators Demo

52. Edit & Continue Demo

53. So Where Have We Been? Security Securing strings Security Context Access Control Encryption Encrypting XML Framework & Language Enhancements GenericsIterators Edit and Continue Console enhancements

54. Changes to the Console Demo With thanks to Kit George and GotDotNetGotDotNet

55. © 2004 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.