Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If you write a PHP application, where you have to deliver the compiled code to the customer, how could you include a functionality to send encrypted data from that application to others, and include those needed keys inside the code, so the customer cannot reverse engineer it so easily?

Just including the keys in the code and compile it with ionCube doesen't seem the best solution for this:

How secure is ionCube compiled code? ... not secure enough

share|improve this question
1  
I want to deliver a complete linux server with Apache running and that PHP code. And that code will send encrypted data to other machines. So I would need to include a function for encrypting in PHP somehow –  rubo77 Jun 25 '13 at 13:30
    
I program a medicine-software with some patient data and those data is stored on the harddrive and sent via ssh to another machine. there it is decrypted with the same key. this key is at the moment inside my ionCube compiled code on both mashines, so the question is about the probability, someone takes the effort to get that key from my code to decrypt the patient-data. –  rubo77 Jun 28 '13 at 5:45

5 Answers 5

With the standard engine, you can't. There are a number of code obfuscator available as well as several PHP code protection tool but none will offer you good protection against an attacker who knows what he's doing.

There is one additional issue that I read in your description of your problem: you seem to want to protect passwords or other secret data using code obfuscation. If that is indeed the case, then stop right there: there is NO way to protect such data from someone with a debugger if you follow that path. All you can do is slow down a potential attacker so your only hope is that the data you want to protect is not worth the time spent retrieving it.

If you really must provide robust data security in your application, you'll need to find another model (which will depend on what you're doing, exactly).

share|improve this answer
    
maybe I could use ionCuba and additionally such an obfuscator then only for my function, that encrypts the data to send? –  rubo77 Jun 25 '13 at 13:31
    
@rubo77 Nope, read everything again –  copy Jun 25 '13 at 13:38
    
So there is no real solution to my problem. But I have to deliver that software anyway, and it has to be able to run offline and store encrypted data. so I guess I have to live with that rest risk and just use code- obfuscasion –  rubo77 Jun 25 '13 at 13:52
1  
@rubo77 ops, not exactly. Now that you explained a little better your problem, take a look at those hardware solutions. Reseach a bit about Java Cards, for example: you could make the encryption part of your system happen inside it... –  woliveirajr Jun 25 '13 at 14:17
    
@rubo77 In addition to what woliveirajr said, you also should remember that, sometimes, good enough really is good enough: you should explain exactly what you're trying to achieve because, in the end, all security decision is about trade-off and it's possible you do not, actually, need that much security. –  Stephane Jun 27 '13 at 10:00

Well, you know that every software in the end-user (be it a client, a regular costumer that is viewing a video, etc) can be reverse-engineered.

And that applies to any solution like "download the keys from a server", because once your program is descompiled, the user has access to it.

I don't think anyone here will be able to give you a better solution than those comercial tools already give you, so if you just want to make it harder for your client, go with those obfuscation - encryption solutions, and hope for the best.

You could also try using some custom hardwre (like a token) that will have part of the code, or some essencial function, inside it. And you can also have some webservice, so that your client will acess your webserver and just receive the data after you do some processing. And, of course, both these alternatives have drawbacks.

share|improve this answer
2  
+1 for "custom hardwre" –  rubo77 Jun 25 '13 at 13:58

Since your comment clarified that you need to deliver a whole machine (or VM) and if you have that in mind then you're into a different ballgame. Forget trying to do anything to or with the PHP, it's not secure when the attackers have access to it and trying to make it that way is arguably a fools errand.

Delivering the whole machine however has much more scope for securing access. You can probably get some help if you have scope to dump Linux derivatives in favour of a BSD which has a more robust security model as I understand it.

Security is always relative. If they have control of the box and are determined, resourced and skilled enough they'll get through whatever you implement. Other options might be more profitable along the lines of allowing them to think they've broken your security and logging when the usage agreements have been broken for you to charge them accordingly.

share|improve this answer

For additional protection than encoding already gives, deviating from a standard PHP build would offer some advantages, and you could use a custom C based module where the key is compiled into the module and not existing within the PHP code. However consider what protection there is to the data before it is encrypted; PHP itself is opensource and can be modified, so there are inherent risks from that and hardware solutions mentioned in replies may therefore not help, and are not immune to reverse engineering.

Steinberg used hardware dongles for Cubase, and they were successfully reverse engineered years back and software emulations released. Despite sophisticated on-chip anti-tamper protection such as light detectors and signal voltage monitoring, the hardware set-top box viewing cards used for a UK TV service called on-digital were successfully reverse engineered, allegedly by a competitor, leading to cloned cards being produced and the resultant demise of the company. The aim with protection is to make reverse engineering as tricky, expensive, and time consuming as possible, but it can never be prevented.

share|improve this answer
    
This question is not about securing the source code, it is about storing some data encrypted on the harddrive and the user shouldnt be able to decrypt it though he has my sourcecode –  rubo77 Jun 30 '13 at 5:53
    
Securing the keys and the point at which keys are used is what requires particular consideration, and no single mechanism will likely achieve what you want. A multi-faceted approach is required, which might include the very choice of language that you use; there is no "quick fix", and you are making life difficult for yourself right off the bat by using PHP. –  Nick Jul 3 '13 at 10:55

When you deliver a working system into the hands of your attacker, you cannot prevent them from reverse-engineering it. There are no exceptions.

But with clever distribution of keys and certificates, you can alleviate some of the trouble. If each user gets his own key and certificate (signed by you), then you can uniquely identify that user by anything he signs. Sharing his key would reveal the identity of the person who shared it.

Likewise, by distributing public keys for encrypting outbound data, you can limit decryption to only those machines that possess the associated private key.

IN RESPONSE TO COMMENT

only need the strictly confidential data somehow stored on the harddrive encrypted and the decryption should be only possible through my software.

You lost at "decryption should only be possible through my software". This is 100% absolutely positively impossible. What you've described is, exactly, DRM. Read Cory Doctrow's explanation of this from almost a decade ago. Some of the smartest and most financially-motivated individuals have worked on this, and continue to work on this to this day, and at no point has it ever actually worked. Because it can't.

What you can instead do is have decryption done only on your server, or a similar solution. The way (the ONLY way) to prevent the client from decrypting your data is to not give him the key. Which means he can't be the one decrypting it.

share|improve this answer
    
I don't need any certification to identify the encrypting personality. I only need the strictly confidential data somehow stored on the harddrive encrypted and the decryption should be only possible through my software. –  rubo77 Jun 30 '13 at 5:52
    
@rubo77 Edited to answer –  tylerl Jun 30 '13 at 6:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.