0

I have made a program which has sensitve data hardcoded into it. Let's imagine that sensitve data is the password for my safe at home.

I realized that it is pretty unsecure to have the data hardcoded in the source code of the application. If somebody was able to break into my system, he/she could use a hex editor/debugger to find that string. So I came up with the idea to create a file on the harddrive containing the password, encrypt it with a strong algorithm, and then let the program ask for the key on startup. If the correct key is entered, the application will be able to parse the content. If a wrong key is entered, the application will parse garbage and crash, but the attacker can't get the password. To make sure nobody else can get hold of that key, I would print it out on a piece of paper and store it at home. My main problem is:

I want to use a secure algorithm for encryption and at the same time have a relatively small key. The algoithms I had a look at so far (RSA, AES) use long keys which I do not want to type in everytime I start the application. Is there an algorithm which fits my needs, or maybe another "plan" which is as secure as the idea I had?

PS: I know that when the application has loaded the password into memory after a successful boot, an attacker could get hold of it there. But that's another topic for another day.

  • Just for clarification, is this application you've created for personal use on your computer only or will it be available for other users on their machines as well? – nd510 Mar 14 '17 at 21:16
  • It is for personal use, however running on a remote machine which is accesible over the internet. – thesys Mar 14 '17 at 21:18
  • Windows or Linux based machine? – nd510 Mar 14 '17 at 21:20
  • Linux based machine – thesys Mar 14 '17 at 21:21
  • i would use a PBKDF instead of an encrypted password; why store more than needed? – dandavis Mar 14 '17 at 21:22
1

Since you mentioned in the comments that this is a remote linux machine accesible over the internet. I would setup SSH with 2-factor authentication.

Example of SSH-2FA: https://www.digitalocean.com/community/tutorials/how-to-set-up-multi-factor-authentication-for-ssh-on-ubuntu-14-04

Also, you mentioned it is for personal use, so if they were able to have access to the machine in the first place, like you mentioned they would be able to reverse engineer your program even with the password approach, since its assumed they have access to your machine, they can just install some kind of monitoring software/keylogger and capture the password.

As mentioned by dandavis, PBKDF2 can be used:

"PBKDF2 applies a pseudorandom function, such as hash-based message authentication code (HMAC), to the input password or passphrase along with a salt value and repeats the process many times to produce a derived key, which can then be used as a cryptographic key in subsequent operations. The added computational work makes password cracking much more difficult, and is known as key stretching." Source: https://en.wikipedia.org/wiki/PBKDF2

But overall, since it is only running on your personal machine, I would focus on securing the machine itself then worry about the application. Setup some firewalls rules and SSH with 2FA would be my suggestions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.