I am learning about file formats. I have an application that will do analytics and will have some personal information. I need to make it such that only some people are able to access data and even those people get very limited access according to an api that I will provide. I am thinking about encryption as well as using a proprietary format to make it difficult to reverse engineer anything. Encryption will allow only people with key to access the data and file format will stop people from looking into the data directly and using only an api of the platform. Although I am not very knowledgeable about it, I have heard that it is relatively easy to reverse engineer file formats. I want to create a file format that will be difficult to reverse engineer so that application is safe. Please give me pointers on what will help make a format difficult to reverse engineer. Also, are there any metrics that help know safety of an algorithm against reverse engineering attack?
closed as too broad by Steve, Benoit Esnard, Anders, Xander, this.josh May 23 '17 at 6:04
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
I am thinking about encryption as well as using a proprietary format to make it difficult to reverse engineer anything..... I want to create a file format that will be difficult to reverse engineer so that application is safe.
A file format which is difficult to reverse engineer is way more difficult to implement correctly in the application than a simple file format. This means testing the application will be harder and strange and hard to reproduce bugs will occur. Also probably security relevant bugs will be introduced without somebody noticing it because the code to support a complex format is way harder to review than code supporting a simple format.
Because of this the application will not be more safe but actually less safe.
In summary: don't try to reach security by adding unneeded complexity. Instead keep it simple and rely on properly implemented encryption for security, since you want to use encryption anyway.
Creating a file format that is difficult to reverse-engineer is something you shouldn't aim for because it's likely to be unnecessarily time-consuming and in the end ineffective.
If a user has access to the application, it's often trivial to reverse-engineer the format by altering small amounts of data in the application and observing the changes in the file. You have to expect that this is easier than reverse-engineering obfuscated executables.
If you're concerned that users may extract sensitive data from the files you gave them access to, you have to overthink the design of your application. This is not something that can be solved by obfuscation.