2

I understand that in asymmetric crypto systems:

  1. The public key is generally used to encrypt data and only the private key can be used to decrypt that data.
  2. It's trivial to derive a public key from the private key (see this SO question).

Firstly, is this correct?

My goal is to supply data with my application that is difficult to decrypt and impossible to change, and so I want to be able to encrypt my data using a private key (which only I have) and allow my application to decrypt that data during runtime (hiding the public key as much as possible).

I understand that this isn't fool-proof, however, I want to stop casual re-use of the data supplied with my application.

Can anyone suggest an algorithm (preferably part of openssl) that can be used to achieve my goal? Looking at RSA_private_encypt, for example, shows that the encrypted data is of size RSA_size() (something like 128-bytes), which is because that function is used to generate signatures, not encrypted data. Is there a private encryption algorithm that generates data equal to the size of the plaintext data?

Improve this question
7
  • If you "hide your public key as much as possible", wouldn't that turn it into a private key?
    – Joachim Sauer
    May 16, 2012 at 12:03
  • How much data will you be distributing? Why can't your application get it (encrypted) from an online source with a decryption key (also downloaded)?
    – Jaydee
    May 16, 2012 at 12:31
  • @JoachimSauer Not really; I know it can be found given enough skill, but I don't want to make it easy.
    – trojanfoe
    May 16, 2012 at 12:43
  • @Jaydee I don't want to force internet access or slowdown application start-up, so the data needs to be immediately available.
    – trojanfoe
    May 16, 2012 at 12:44
  • Perhaps this should be migrated to security.stackexchange.com
    – Oleksi
    May 16, 2012 at 14:11

1 Answer 1

Reset to default
1

If you both encrypt and decrypt than you don't need public key.

You can use one of Rijndael implementations to encrypt your data before shipping the application and decrypt during runtime.

You might even want to use a license file with unique salt for Rijndael (that same salt should be used to encrypt the data). This way your data could not be used with another installation without copying the license key.

Improve this answer
5
  • Isn't that symmetric encryption? I was hoping for an asymmetric solution.
    – trojanfoe
    May 16, 2012 at 13:31
  • Do you want to prevent malicious or accidental data change?
    – eitanpo
    May 16, 2012 at 14:06
  • +1 I really just want to protect my data (images, font, etc.) from being stolen. I think symmetric encryption might be my only option.
    – trojanfoe
    May 16, 2012 at 14:33
  • You still need a secure method of dispersing your key(s).
    – Michael Arnell
    May 16, 2012 at 14:54
  • @MichaelArnell I'll look into methods of hiding the key; it's only to fend off casual admirers as any decent cracker would laugh at the attempt. However, one thing I have going for me is that crackers are generally only interested in copy-protection and not some poxy application assets :)
    – trojanfoe
    May 16, 2012 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.