4

I already have my credentials stored in an xml file.

$myCredential=Get-Credential -Message "Enter the credentials."
$myCredential | Out-File "C:\cred.xml"

Now, I have a script that prompts and gets new credential when it is run.

$newCredential= Get-Credential -Message "Enter your credential."

So, how do I check if the newly provided credential is matching with the old credential without decrypting the credentials to human understandable actual plain text?

2 Answers 2

5

Here is how to securely compare two SecureString objects without decrypting them:

# Safely compares two SecureString objects without decrypting them.
# Outputs $true if they are equal, or $false otherwise.
function Compare-SecureString {
  param(
    [Security.SecureString]
    $secureString1,

    [Security.SecureString]
    $secureString2
  )
  try {
    $bstr1 = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($secureString1)
    $bstr2 = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($secureString2)
    $length1 = [Runtime.InteropServices.Marshal]::ReadInt32($bstr1,-4)
    $length2 = [Runtime.InteropServices.Marshal]::ReadInt32($bstr2,-4)
    if ( $length1 -ne $length2 ) {
      return $false
    }
    for ( $i = 0; $i -lt $length1; ++$i ) {
      $b1 = [Runtime.InteropServices.Marshal]::ReadByte($bstr1,$i)
      $b2 = [Runtime.InteropServices.Marshal]::ReadByte($bstr2,$i)
      if ( $b1 -ne $b2 ) {
        return $false
      }
    }
    return $true
  }
  finally {
    if ( $bstr1 -ne [IntPtr]::Zero ) {
      [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($bstr1)
    }
    if ( $bstr2 -ne [IntPtr]::Zero ) {
      [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($bstr2)
    }
  }
}

You can use the above function to compare the Password property of two PSCredential objects thus:

$theyMatch = Compare-SecureString $cred1.Password $cred2.Password
if ( $theyMatch ) {
  ...
}
1
  • Yes. This does the thing. I observe this to be far more secure.
    – picachu
    Feb 15, 2018 at 16:34
0

You can use the GetNetworkCredential() Method to get the plain text without saving it anywhere, just validate it.

if ($newCredential.GetNetworkCredential().Password -eq $oldCredential.GetNetworkCredential().Password )
{
return "Password is match"
}
2
  • Yes. I just wanted to know if it is possible because I can't seem to find any means of doing so without using the plain text. That will be such a relief.
    – picachu
    Feb 15, 2018 at 14:17
  • 3
    This is not recommended because it decrypts the passwords in memory first. Feb 15, 2018 at 15:33

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.