I made an J2SE application that uses AES (in CBC mode using BouncyCastle library) to encrypt application config file & some user provided files.
I stored the raw AES key in a file that is stored on a flash drive. To use the application the flash drive should be plugged to machine first. Users doesn't have physical access to the port that flash drive it connected to.
But the problem is: How about copying KEY file or opening it using an HEX editor & writing bytes on a paper?
How Can I protect key file against copying (by the file or visually)?
Note: I thought about loading the key into RAM and forcing the user to unplug the flash drive but this only decreases the time for copying the key.