2

I understand that in asymmetric crypto systems:

  1. The public key is generally used to encrypt data and only the private key can be used to decrypt that data.
  2. It's trivial to derive a public key from the private key (see this SO question).

Firstly, is this correct?

My goal is to supply data with my application that is difficult to decrypt and impossible to change, and so I want to be able to encrypt my data using a private key (which only I have) and allow my application to decrypt that data during runtime (hiding the public key as much as possible).

I understand that this isn't fool-proof, however, I want to stop casual re-use of the data supplied with my application.

Can anyone suggest an algorithm (preferably part of openssl) that can be used to achieve my goal? Looking at RSA_private_encypt, for example, shows that the encrypted data is of size RSA_size() (something like 128-bytes), which is because that function is used to generate signatures, not encrypted data. Is there a private encryption algorithm that generates data equal to the size of the plaintext data?

||improve this question
  • If you "hide your public key as much as possible", wouldn't that turn it into a private key? – Joachim Sauer May 16 '12 at 12:03
  • How much data will you be distributing? Why can't your application get it (encrypted) from an online source with a decryption key (also downloaded)? – Jaydee May 16 '12 at 12:31
  • @JoachimSauer Not really; I know it can be found given enough skill, but I don't want to make it easy. – trojanfoe May 16 '12 at 12:43
  • @Jaydee I don't want to force internet access or slowdown application start-up, so the data needs to be immediately available. – trojanfoe May 16 '12 at 12:44
  • Perhaps this should be migrated to security.stackexchange.com – Oleksi May 16 '12 at 14:11
1

If you both encrypt and decrypt than you don't need public key.

You can use one of Rijndael implementations to encrypt your data before shipping the application and decrypt during runtime.

You might even want to use a license file with unique salt for Rijndael (that same salt should be used to encrypt the data). This way your data could not be used with another installation without copying the license key.

||improve this answer
  • Isn't that symmetric encryption? I was hoping for an asymmetric solution. – trojanfoe May 16 '12 at 13:31
  • Do you want to prevent malicious or accidental data change? – eitanpo May 16 '12 at 14:06
  • +1 I really just want to protect my data (images, font, etc.) from being stolen. I think symmetric encryption might be my only option. – trojanfoe May 16 '12 at 14:33
  • You still need a secure method of dispersing your key(s). – Michael Arnell May 16 '12 at 14:54
  • @MichaelArnell I'll look into methods of hiding the key; it's only to fend off casual admirers as any decent cracker would laugh at the attempt. However, one thing I have going for me is that crackers are generally only interested in copy-protection and not some poxy application assets :) – trojanfoe May 16 '12 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.