0

I am in the final stages of development for my Revit plugin. This plugin is programmed in C#, and distributed via a DLL. One of the DLLs is an encrypted SQLite database (with proprietary data) that is in the form of a DLL. Currently, in development stages, the decryption key for the SQLite database is hardcoded in my main DLL (the program's DLL). For distribution, since DLLs are easily decompilable, I am in need of a new method to decrypt the DLL. My solution is to send our decryption keys from our servers securely to the host's computer.

I was looking in POST, thinking it was more secure than GET, but upon research, it appears it's similarly insecure, only more "obscure" than GET. I also looked into HTTPS, but Hostgator requires extra money for HTTPS use.

I am in need of some advice - are there any custom solutions I can do to implement this?

  • Are you trying to prevent the key from being intercepted during transmission or keeping it out of the hands of your users? – Mike Oct 24 '13 at 15:11
  • Idealistically, both. For interception, if the code is encrypted during transmission, that should be negligible, right? – theGreenCabbage Oct 24 '13 at 15:13
  • You could look into making your .NET assembly (DLL) harder to decompile and secure the assembly itself. – Bernard Oct 24 '13 at 17:30
  • Maybe the Diffie-Hellman-Algorithm is the right answer ;) Also used on aesload.de – user106066 Oct 25 '13 at 21:34
3

You can't secure a DB that is physically delivered to and then decrypted on a Client's computer from the Client itself.

It simple can't be done... It's like saying you want to store a Safe in someone house and send someone in with a key, when you need access to it. You want to insure that no one grabs that key out if his hand. You are asking "Where can i hide the Key?" But anyway you cut it, he as to take the key out to open the safe. The the home owner will see it, he can grab it, he can wait for the safe to be opened then stop it from closing... There is just too many holes in this system because the environment is not safe. You simply can't secure one file in an unsafe environment and at the same time keep it accessible.

The solution is simply never give all the data to the client in the first place. You need to created a service that delivers the data on an as need basis.

  • There may be a way to decrypt the encrypted SQLite database in memory and operate on the memory copy directly from the application. Of course a determined hacker can still scan the applications memory and recover the decrypted database but it's admittedly much harder for most casual hack. – Codism Oct 24 '13 at 16:54
  • @Codism They can simply hack the client that reads the SQL DB (that is also installed Locally). Anyway you cut it, that client knows how to read the key and open the the DB. A simple code modification to the client makes a full data dump. – Morons Oct 24 '13 at 17:00
  • @Codism Can you explain a little more on decrypting the encrypted SQLite database in memory and operating on the memory copy? This application is written in C#. If this is an option, then it's worth a try. – theGreenCabbage Oct 24 '13 at 19:41
0

This is not a direct answer but I am afraid a comment is too short to finish my point.

You are trying to keep the key out of the hands of your users. HTTPS in this case does not help too much. Here is why: additional to HTTPS, you will need some authentication information passed from the your application. Without authentication, a user just use a browser and hit the link, voila, the decryption/encryption key. So it comes down to protect this authentication information, which is embed again in one of your binaries and you are back to your original problem. To prevent De-compilation, try these obfuscation products. They often do a good enough job to protect your from reverse engineering.

To avoid key being intercepted during transmission, you do need HTTPS but if you cannot use it because of budget concern, you can roll your own asymmetric encryption over HTTP. All you need to do is to encrypt the key on the server with a private key and decrypt the key in your program with a public key.

  • HTTPS only protects from interception during devilry, Not after. It won't help his situation on bit. – Morons Oct 24 '13 at 16:32
  • @Morons, do you think code obfuscation can help with the decryption key issue? – theGreenCabbage Oct 24 '13 at 19:43
  • @theGreenCabbage obfuscation makes the code harder to trace. Basically instead of tracing good code with well named variables you need to trace code with variables called vs694658 and methods called gtykas67() it makes it a royal pain. Obfuscation has nothing to do with decryption. – Morons Oct 24 '13 at 20:01
  • @theGreenCabbage it really depends on the value of the data you are trying to protect.. The more its worth, the more more effort someone will spend trying to access it. – Morons Oct 24 '13 at 20:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.