0
$\begingroup$

Respected community,

I am using the OpenSSL API's, especially libcrypto and libssl and I am really depressed, thinking about side channel attacks on my implementation. My target platform is Windows, and I am programming in C and C++ and I am linking the libraries dynamically.

I am doing symmetric encryption of some files and the key has to be stored in the executable. I know, this is extremely insecure, and many white-box cryptography techniques, have been broken. But unfortunately, in this experimental project I am working on, there is no scope for public key cryptography here. But, I have found some cool ways to obfuscate the key and I am trying to personally test how strong they are, for learning and research purposes.

My concern is can an attacker see the values, that I am passing to the OpenSSL API functions, assuming the attacker has access to the Windows system in which the executable is running and can do reverse engineering. I am reckoning that the attacker can find the OpenSSL API, symbol names and trace the key out.

Will it make any difficulty for the attacker if the OpenSSL libraries are linked statically and not dynamically?

Once the application is running, can the attacker do API hooking to read my values? Will the choice between static / dynamic linkage help here, in increasing effort for the attacker in this scenario?

$\endgroup$
6
  • 1
    $\begingroup$ Are you using windows on the cloud? if not, why do you fear from the side-channel attack? If the attacker can execute side-channel attack on your windows machine, then you have more serious problem. Also, what about a key logger to steal your password that used in OpenSLL to secure your private keys? $\endgroup$
    – kelalaka
    Oct 17, 2023 at 17:21
  • $\begingroup$ @kelalaka Thankyou very much for the reply! There is no need to worry about key loggers, because there is no option for the user to enter a password. I am trying to protect the graphical assets of an old video game, which I am refurbishing and the contents need to be decrypted by the game in realtime. The source code of the game is old and is written in such a way that too much modifications will break everything :( I need to protect the graphical assets and the only way, I can do this is by embedding the key in the executable itself. I fear reverse engineering might reveal this. $\endgroup$
    – Aravind A
    Oct 18, 2023 at 5:32
  • $\begingroup$ @kelalaka Please read my previous comment. The users of the game is the attacker! They might steal the graphics :( We want the user to only play the game and not extract the pure graphical assets. $\endgroup$
    – Aravind A
    Oct 18, 2023 at 5:34
  • $\begingroup$ This is more about how valuable the assets are. The more valuable they become, the harder to protect. In this case, a good lawyer is required and this works since most money is spent on the games in the countries where the law is working to some degree. Remember, streaming companies cannot protect their movies unless all users start to use Encrypted HDMI. First, in the last, you should really tell your actual case, the details matter. Yes, some games encrypt all the graphics to make the stealing harder. No fear, who got money and time can do that and use it, if there is no LAW! $\endgroup$
    – kelalaka
    Oct 18, 2023 at 5:46
  • $\begingroup$ @kelalaka Yes, IP laws are great, but enforcing them is also a challenge, because it might be difficult to find the exact person who does this. Also, most of the project is out of passion of the original people who started the project, but still we are thinking to make the graphical asset extraction harder and not impossible. $\endgroup$
    – Aravind A
    Oct 18, 2023 at 5:51

1 Answer 1

1
$\begingroup$

If the attacker has access to the account running your software, they can do a lot, possibly including (depends on details such as installation paths and other permissions):

  • Replacing the shared libraries with ones which will log/report all calls they want
  • Adding other shared libraries doing the same thing and making sure your app uses those instead of the standard ones
  • Trace the app (like a debugger would)
  • Possibly replace parts of the app.

Probably even simpler, they could take the app and copy it to their box and do whatever they want there.

If they have access to the computer but with a different (non-admin) account, and permissions are correctly set up to prevent other users from accessing the app, then it could be more difficult, and that's indeed where side-channel attacks come in, which are quite a lot more difficult.

But it may be a lot easier to get access to the installer for the app than to hack it on your box.

As long as you include a private key in your app, you are most likely to have someone hack it, whatever the level of obfuscation or "cool things" you add onto it.

$\endgroup$
4
  • $\begingroup$ Thankyou very much :) Will making the libraries statically linked help in some way? Irrespective of the attacker's account privilege, the attacker might still take out the hard drive and access it's files from a Linux machine and then they might be able to reverse engineer the key still :( $\endgroup$
    – Aravind A
    Oct 17, 2023 at 15:05
  • $\begingroup$ Are there practical ways to make this really hard (not impossible) for the attacker so much to the point that they might give up ? In my unfortunate scenario, there is no other way but to have the AES encryption key in the application (*.exe) itsef :( $\endgroup$
    – Aravind A
    Oct 17, 2023 at 15:09
  • $\begingroup$ @VivekanandV Statically linking will remove some of the possibilities described above, but it leaves many options open. A hard disk can be encrypted so that it can only be accessed from the PC it is installed in. As usual, it's a matter of knowing who is your enemy, and what their motivations and means are (a threat assessment) to find the relevant level of protection you need. Not the same thing to protect military secrets or medical records or from the NSA than the inventory of your garden gnomes from the neighbour. $\endgroup$
    – jcaron
    Oct 17, 2023 at 16:05
  • $\begingroup$ Thankyou very much for the reply :) But even if it is statically linked, will the attacker find the names of the symbols in the exe? I cannot encrypt the hard drive unfortunately, since that's a personal choice of some one who uses the code and they may choose not to. I am trying to protect the graphical assets of an old game, but the code of the game is the result of a lot of developers work and cannot be modified too much :( $\endgroup$
    – Aravind A
    Oct 18, 2023 at 5:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.