CODEWITHSUNDEEP
securitycryptographyreverse-engineeringencryption-symmetric
Denisdillo
Denisdillo

Reputation: 31

Securing symmetric key

In my project (windows desktop application) I use symmetric key in order to encrypt/decrypt some configurations that need to be protected. The key is hardcoded in my code (C++).

  1. What are the risks that my key will be exposed by reverse engineering ? (the customers will receive the compiled DLL only)
  2. Is there a way for better security for managing the key?
  3. Are there open source or commercial products which I can use

Upvotes: 3

Views: 291

Answers (2)

Rob Napier
Rob Napier

Reputation: 299265

What are the risks that my key will be exposed by reverse engineering ? (the customers will receive the compiled DLL only)

100%. Assuming of course that the key protects something useful and interesting. If it doesn't, then lower.

Is there a way for better security for managing the key?

There's no security tool you could use, but there are obfuscation and DRM tools (which are a different problem than security). Any approach you use will need to be updated regularly to deal with new attacks that defeat your old approach. But fundamentally this is the same as DRM for music or video or games or whatever. I would shop around. Anything worthwhile will be regularly updated, and likely somewhat pricey.

Are there open source or commercial products which I can use

Open source solutions for this particular problem are... probably unhelpful. The whole point of DRM is obfuscation (making things confusing and hidden rather than secure). If you share "the secret sauce" then you lose the protection. This is how DRM differs from security. In security, I can tell you everything but the secret, and it's still secure. But DRM, I have to hide everything. That said, I'm sure there are some open source tools that try. There are open source obfuscation tools that try to make it hard to debug the binary by scrambling identifiers and the like, but if there's just one small piece of information that's needed (the configuration), it's hard to obfuscate that sufficiently.

If you need this, you'll likely want a commercial solution, which will be imperfect and likely require patching as it's broken (again, assuming that it protects something that anyone really cares about). Recommending specific solutions is off-topic for Stack Overflow, but google can help you. There are some things specific for Windows that may help, but it depends on your exact requirements.

Keep in mind that the "attacker" (it's hard to consider an authorized user an "attacker") doesn't have to actually get your keys. They just have to wait until your program decrypts the configurations, and then read the configurations out of memory. So you'll need obfuscation around that as well. It's a never-ending battle that you'll have to decide how hard you want to fight.

Upvotes: 1

Richard Schwartz
Richard Schwartz

Reputation: 14628

Windows provides a key storage mechanism as part of the Crypto API. This would only be useful for you if you have your code generate a unique random key for each user. If you are using a single key for installations for all users, it will obviously have to be in your code (or be derived from constants that are in your code), and thus couldn't really be secure.

Upvotes: 3

Related Questions