I am using the OpenSSL API's, especially
libssl and I am really depressed, thinking about side channel attacks on my implementation. My target platform is Windows, and I am programming in C and C++ and I am linking the libraries dynamically.
I am doing symmetric encryption of some files and the key has to be stored in the executable. I know, this is extremely insecure, and many white-box cryptography techniques, have been broken. But unfortunately, in this experimental project I am working on, there is no scope for public key cryptography here. But, I have found some cool ways to obfuscate the key and I am trying to personally test how strong they are, for learning and research purposes.
My concern is can an attacker see the values, that I am passing to the OpenSSL API functions, assuming the attacker has access to the Windows system in which the executable is running and can do reverse engineering. I am reckoning that the attacker can find the OpenSSL API, symbol names and trace the key out.
Will it make any difficulty for the attacker if the OpenSSL libraries are linked statically and not dynamically?
Once the application is running, can the attacker do API hooking to read my values? Will the choice between static / dynamic linkage help here, in increasing effort for the attacker in this scenario?