Add support for additional entropy for encrypting the password

Author: Erwin Koek

src/Ookii.Dialogs.Wpf/CredentialDialog.cs

@@ -52,6 +52,7 @@ public partial class CredentialDialog : Component
     {
         private string _confirmTarget;
         private NetworkCredential _credentials = new NetworkCredential();
+        private byte[] _additionalEntropy;
         private bool _isSaveChecked;
         private string _target;
 
@@ -163,6 +164,27 @@ private set
             }
         }
 
+        /// <summary>
+        /// Gets or sets the optional entropy to increase the complexity of the password encryption.
+        /// This property is only used if the user chose to save the credentials.
+        /// </summary>
+        /// <value>
+        /// A byte array with values of your choosing.
+        /// The default value is <see langword="null" /> for no added complexity.
+        /// </value>
+        [Browsable(false)]
+        public byte[] AdditionalEntropy
+        {
+            get
+            {
+                return _additionalEntropy;
+            }
+            set
+            {
+                _additionalEntropy = value;
+            }
+        }
+
         /// <summary>
         /// Gets the user-specified user name and password in a <see cref="NetworkCredential"/> object.
         /// </summary>
@@ -551,7 +573,7 @@ public void ConfirmCredentials(bool confirm)
                     }
                 }
 
-                StoreCredential(Target, Credentials);
+                StoreCredential(Target, Credentials, AdditionalEntropy);
             }
         }
 
@@ -560,6 +582,7 @@ public void ConfirmCredentials(bool confirm)
         /// </summary>
         /// <param name="target">The target name for the credentials.</param>
         /// <param name="credential">The credentials to store.</param>
+        /// <param name="additionalEntropy">Additional entropy for encrypting the password.</param>
         /// <exception cref="ArgumentNullException">
         /// <para>
         ///   <paramref name="target"/> is <see langword="null" />.
@@ -585,7 +608,7 @@ public void ConfirmCredentials(bool confirm)
         ///   form "Company_ApplicationName_www.example.com".
         /// </para>
         /// </remarks>
-        public static void StoreCredential(string target, NetworkCredential credential)
+        public static void StoreCredential(string target, NetworkCredential credential, byte[] additionalEntropy = null)
         {
             if( target == null )
                 throw new ArgumentNullException("target");
@@ -598,7 +621,7 @@ public static void StoreCredential(string target, NetworkCredential credential)
             c.UserName = credential.UserName;
             c.TargetName = target;
             c.Persist = NativeMethods.CredPersist.Enterprise;
-            byte[] encryptedPassword = EncryptPassword(credential.Password);
+            byte[] encryptedPassword = EncryptPassword(credential.Password, additionalEntropy);
             c.CredentialBlob = System.Runtime.InteropServices.Marshal.AllocHGlobal(encryptedPassword.Length);
             try
             {
@@ -618,6 +641,7 @@ public static void StoreCredential(string target, NetworkCredential credential)
         /// Retrieves credentials for the specified target from the operating system's credential store for the current user.
         /// </summary>
         /// <param name="target">The target name for the credentials.</param>
+        /// <param name="additionalEntropy">The same entropy value that was used when storing the credentials.</param>
         /// <returns>The credentials if they were found; otherwise, <see langword="null" />.</returns>
         /// <remarks>
         /// <para>
@@ -632,7 +656,7 @@ public static void StoreCredential(string target, NetworkCredential credential)
         /// <exception cref="ArgumentNullException"><paramref name="target"/> is <see langword="null" />.</exception>
         /// <exception cref="ArgumentException"><paramref name="target"/> is an empty string ("").</exception>
         /// <exception cref="CredentialException">An error occurred retrieving the credentials.</exception>
-        public static NetworkCredential RetrieveCredential(string target)
+        public static NetworkCredential RetrieveCredential(string target, byte[] additionalEntropy = null)
         {
             if( target == null )
                 throw new ArgumentNullException("target");
@@ -653,7 +677,7 @@ public static NetworkCredential RetrieveCredential(string target)
                     NativeMethods.CREDENTIAL c = (NativeMethods.CREDENTIAL)System.Runtime.InteropServices.Marshal.PtrToStructure(credential, typeof(NativeMethods.CREDENTIAL));
                     byte[] encryptedPassword = new byte[c.CredentialBlobSize];
                     System.Runtime.InteropServices.Marshal.Copy(c.CredentialBlob, encryptedPassword, 0, encryptedPassword.Length);
-                    cred = new NetworkCredential(c.UserName, DecryptPassword(encryptedPassword));
+                    cred = new NetworkCredential(c.UserName, DecryptPassword(encryptedPassword, additionalEntropy));
                 }
                 finally
                 {
@@ -896,7 +920,7 @@ private NativeMethods.CREDUI_INFO CreateCredUIInfo(IntPtr owner, bool downlevelT
 
         private bool RetrieveCredentials()
         {
-            NetworkCredential credential = RetrieveCredential(Target);
+            NetworkCredential credential = RetrieveCredential(Target, AdditionalEntropy);
             if( credential != null )
             {
                 UserName = credential.UserName;
@@ -906,17 +930,17 @@ private bool RetrieveCredentials()
             return false;
         }
 
-        private static byte[] EncryptPassword(string password)
+        private static byte[] EncryptPassword(string password, byte[] additionalEntropy)
         {
-            byte[] protectedData = System.Security.Cryptography.ProtectedData.Protect(System.Text.Encoding.UTF8.GetBytes(password), null, System.Security.Cryptography.DataProtectionScope.CurrentUser);
+            byte[] protectedData = System.Security.Cryptography.ProtectedData.Protect(System.Text.Encoding.UTF8.GetBytes(password), additionalEntropy, System.Security.Cryptography.DataProtectionScope.CurrentUser);
             return protectedData;
         }
 
-        private static string DecryptPassword(byte[] encrypted)
+        private static string DecryptPassword(byte[] encrypted, byte[] additionalEntropy)
         {
             try
             {
-                return Encoding.UTF8.GetString(System.Security.Cryptography.ProtectedData.Unprotect(encrypted, null, System.Security.Cryptography.DataProtectionScope.CurrentUser));
+                return Encoding.UTF8.GetString(System.Security.Cryptography.ProtectedData.Unprotect(encrypted, additionalEntropy, System.Security.Cryptography.DataProtectionScope.CurrentUser));
             }
             catch( System.Security.Cryptography.CryptographicException )
             {