Quote:
[Originally Posted by r4g3]um once again.
if you wanna use asymmetric crypto and runtime code decryption why hide public (rsa) key ? dont see any reason to do that. if i find "trash" code in disassembly and see a 1024bit rsa key i will definitely drop cracking this one. unless of course someone may try find bugs in your crypto implementations. but VERY few ppl actually do that 
on the other hand 1 leaked key and you are yet another author of cracked shareware ;p |
Well based on what is suggested above by r4g3, someone could go into the exe, find the public key, decrypt the encrypted code, dump it to a file, fix up the PE and run the app forever... I am not saying it is easy to do, but it is not that hard either. For this scheme to work, you need to hide the public key. Asymmetric crypto works much better for -say- securing a comm channel. When the user has access to your binary, a disassembler and some time, it is not as good.
You are all correct that if I implement things correctly, I shouldn't have to hide anything. I really like the idea of not using obscurity as security. Definitely not the right way to go.
I need to come up with a method that makes everything depend on each other so that people cannot change anything in the EXE binary, cannot bypass anything (modification of EXE should not be allowed), cannot modify the public key embedded in the app, etc.. so and so forth. I also need to somehow find a way around dumping. The app will have to do much more than just decrypting the encrypted version of itself and run it. If someone dumps that code to a file and tries to run it, it should somehow know that something is wrong (EXE integrity checking).
What I just said in this post renders my original question useless since trying to hide information is irrelevant. It will eventually be found. Thank you for helping me see that point.
Thank you all for your input and time.