serialization using c#

Question

Can serialization be used as a secure means to store the state of program?

Answer 1

No, Serialization is just a technology to allow you to convert in-memory representations of objects or object graphs into a stream of bytes that can later (with the type definitions), be reconstituted back into the in-memory representation of the same objects. If you want some kind of security you could encrypt the stream of bytes before you persist (store) it to disk or to a database, and then decrypt it again before you de-serialize it, but the Serialzation/Deserialization process itself provides no security.

Answer 2

Nice excerpt from wikipedia:

Serialization, however, breaks the opacity of an abstract data type by potentially exposing private implementation details. To discourage competitors from making compatible products, publishers of proprietary software often keep the details of their programs' serialization formats a trade secret. Some deliberately obfuscate or even encrypt the serialized data.

Another words, serialization in itself is not secure at all, since it can potentially expose data rather than obfuscate or hide data. Human-readable serialization probably makes this dilemma worse.

As a totally side note, may I suggest looking at protocol buffers rather than serialization?

http://code.google.com/apis/protocolbuffers/docs/faq.html

Protobuf-net

Also: Jon Skeet's C# port of the protocol buffers (from Java, I believe...)