ConvertFrom-SecureString is broken on Linux

Travis Plunk (@TravisEz13)

Steps to reproduce

Install PowerShell on Ubuntu 14.04
Launch PowerShell
Run the following:

   $password = Convertto-Securestring -String "PowerShellRocks!" -AsPlainText -Force
   ConvertFrom-SecureString $password

Expected behavior

No error

Actual behavior

The following error is thrown

PS /home/chythu/temp> ConvertFrom-SecureString $password                        ConvertFrom-SecureString : Unable to load DLL 'CRYPT32.dll': The specified
module could not be found.
 (Exception from HRESULT: 0x8007007E)
At line:1 char:1
- ConvertFrom-SecureString $password
- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  - CategoryInfo          : NotSpecified: (:) [ConvertFrom-SecureString], Dl
    lNotFoundException
  - FullyQualifiedErrorId : System.DllNotFoundException,Microsoft.PowerShell
    .Commands.ConvertFromSecureStringCommand

Environment data

Name                           Value
---
PSVersion                      5.1.10032.0
PSEdition                      PowerShellCore
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   3.0.0.0
GitCommitId                    v6.0.0-alpha.7
CLRVersion
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

Updates by Travis Plunk (@TravisEz13) on 2016-04-10

Environment data

> $PSVersionTable
Name                           Value                                           
----                           -----                                           
PSVersion                      6.0.2                                           
PSEdition                      Core                                            
GitCommitId                    v6.0.2                                          
OS                             Darwin 17.5.0 Darwin Kernel Version 17.5.0: M...
Platform                       Unix                                            
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}                         
PSRemotingProtocolVersion      2.3                                             
SerializationVersion           1.1.0.1                                         
WSManStackVersion              3.0

Workaround

The following works

# you should generate your own key
$Key = (3,4,2,3,56,34,254,222,1,1,2,23,42,54,33,233,1,34,2,7,6,5,35,43)       
$s  | ConvertFrom-SecureString -Key $Key

https://github.com/PowerShell/PowerShell/blob/master/src/System.Management.Automation/security/SecureStringHelper.cs#L449

Seems to be CoreCLR that is lacking.

Talked @KrishnaV-MSFT This is not needed for Azure demo. Moving it out of Alpha.10

Came across the same error on MacOS 10.12 Beta (16A270f)

Was just messing around got this:

PS> $User="Jared"
PS> $PWord = ConvertTo-SecureString –String "TestString" –AsPlainText -Force   
PS> $Cred = New-Object -TypeName "System.Management.Automation.PSCredential" –ArgumentList $User, $PWord
PS> ConvertFrom-SecureString -SecureString ($Cred.Password)

Result:

ConvertFrom-SecureString : Unable to load DLL 'CRYPT32.dll': The specified module could not be found.
 (Exception from HRESULT: 0x8007007E)
At line:1 char:1
+ ConvertFrom-SecureString -SecureString ($Cred.Password)
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [ConvertFrom-SecureString], DllNotFoundException
    + FullyQualifiedErrorId : System.DllNotFoundException,Microsoft.PowerShell.Commands.ConvertFromSecureStringComman

Hi,

same library error when trying to use mapped cert: psdrive:

Get-ChildItem Cert:/LocalMachine/

Error:

get-childitem : Unable to load DLL 'crypt32.dll': The specified module could not be found.
(Exception from HRESULT: 0x8007007E)
At line:1 char:1
get-childitem Cert:/LocalMachine/
- CategoryInfo          : NotSpecified: (:) [Get-ChildItem], DllNotFoundException
- FullyQualifiedErrorId : System.DllNotFoundException,Microsoft.PowerShell.Commands.GetChildItemCommand

Ivan Temchenko (@35359595)

Ivan Temchenko (@35359595) good finding! The error definitely should be friendlier. On Linux and macOS Cert:/ provider needs some re-thinking. The way these two systems approach storing certificates are completely different from each other and windows.

Fyi, 16.04.1 with PowerShell v6 alpha 14 still has this same issue

This is holding me back from bringing my modules over to Linux. I'd like to be able to store Web API keys securely on all OSes, not just Windows.

I added the link for information only.

Essentially:

It is impossible to port SecureString because System.Security.Cryptography.ProtectedData is Windows-only. There is no plans to port the API. Core team deprecate the API.
We can keep backward compatibility for SecureString on Windows (including remoting)
PowerShell Core must remain flexible and allow to work with legacy applications.
It is acceptable to use basic authentication in protected environment
Main problem how to detect protected environment vs public environment and what to do (prevent basic authentication, only warn, ...).

Early on, the @PowerShell/powershell-committee discussed introducing a SensitiveString to replace the functional need of SecureString even though both are not secure (the SecureString type would still be needed for backwards compat). A type (whether "Sensitive" or "Secure" is needed to indicate to PowerShell to prompt without echoing the input so it's used more than just for remoting. As for the original issue of this bug, this has been fixed (you don't get an error anymore), just keep in mind the SecureString is internally in plain text.

thanks for the update, looks promising!
may we ask for an approximately timeframe when to expect to be able to utilize this (e.g. in microsoft-debian-stretch-prod debian repository)?

As for the original issue of this bug, this has been fixed (you don't get an error anymore), just keep in mind the SecureString is internally in plain text.

Does anyone have a link to the fix or know what release version it will be available in? I'm still getting crypt32.dll errors in powershell_6.1.3-1.ubuntu.16.04_amd64.deb (same deal with the 6.2.0-rc.1 preview package).

I'm also curious how this fix affects Import/Export-CliXml when the data to be serialized contains SecureString or PSCredential objects.

Ryan Bolger (@rmbolger)

Ryan Bolger (@rmbolger) Could you please check with latest build (6.2.0-RC)?

Ryan Bolger (@rmbolger)

I'm seeing the same as Ryan Bolger (@rmbolger)

/home/hillr
03-20 23:44:55 31ms 11> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      6.2.0-rc.1
PSEdition                      Core
GitCommitId                    6.2.0-rc.1
OS                             Linux 4.4.0-17763-Microsoft #379-Microsoft Wed Mar 06 19:16:00 PST 2019
Platform                       Unix
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

/home/hillr
03-21 00:47:45 35ms 12> ConvertFrom-SecureString -SecureString $ss
ConvertFrom-SecureString : Unable to load shared library 'CRYPT32.dll' or one of its dependencies. In order to help diagnose loading problems, consider setting the LD_DEBUG environment variable: libCRYPT32.dll: cannot open shared object file: No such file or directory
At line:1 char:1
+ ConvertFrom-SecureString -SecureString $ss
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : NotSpecified: (:) [ConvertFrom-SecureString], DllNotFoundException
+ FullyQualifiedErrorId : System.DllNotFoundException,Microsoft.PowerShell.Commands.ConvertFromSecureStringCommand

The cmdlets load directly the CRYPT32.dll

PowerShell/src/Microsoft.PowerShell.Security/security/SecureStringCommands.cs

Line 169 in 8763c0b

exportedString = SecureStringHelper.Protect(SecureString);

PowerShell/src/System.Management.Automation/security/SecureStringHelper.cs

Line 158 in 8763c0b

protectedData = ProtectedData.Protect(data, null,

PowerShell/src/System.Management.Automation/security/SecureStringHelper.cs

Line 449 in 8763c0b

if (!CAPI.CryptProtectData(new IntPtr(&dataIn),

PowerShell/src/System.Management.Automation/security/SecureStringHelper.cs

Line 590 in 8763c0b

internal static extern bool CryptProtectData(

Enable `SecureString` cmdlets for non-Windows (#9199)

Enable `SecureString` cmdlets for non-Windows (PowerShell#9199)

Navigation Menu

Repository navigation

ConvertFrom-SecureString is broken on Linux #1654

Steps to reproduce

Expected behavior

Actual behavior

Environment data

Updates by Travis Plunk (@TravisEz13) on 2016-04-10

Environment data

Workaround

76 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

ConvertFrom-SecureString is broken on Linux #1654

Description

Steps to reproduce

Expected behavior

Actual behavior

Environment data

Updates by Travis Plunk (@TravisEz13) on 2016-04-10

Environment data

Workaround

Activity

oising commented on Aug 5, 2016

hiteshraigandhi commented on Aug 10, 2016

jaredmichaelwilliams commented on Aug 18, 2016

35359595 commented on Oct 2, 2016

vors commented on Oct 2, 2016

ChrisMagnuson commented on Jan 4, 2017

ngetchell commented on Feb 12, 2017

76 remaining items

iSazonov commented on Mar 20, 2019

SteveL-MSFT commented on Mar 20, 2019

vchrizz commented on Mar 21, 2019

rmbolger commented on Mar 21, 2019

iSazonov commented on Mar 21, 2019

rkeithhill commented on Mar 21, 2019

iSazonov commented on Mar 21, 2019

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions