1

I made an J2SE application that uses AES (in CBC mode using BouncyCastle library) to encrypt application config file & some user provided files.

I stored the raw AES key in a file that is stored on a flash drive. To use the application the flash drive should be plugged to machine first. Users doesn't have physical access to the port that flash drive it connected to.

But the problem is: How about copying KEY file or opening it using an HEX editor & writing bytes on a paper?

How Can I protect key file against copying (by the file or visually)?

Note: I thought about loading the key into RAM and forcing the user to unplug the flash drive but this only decreases the time for copying the key.

Improve this question
  • You can always delete the keyfile once your application has read the key in, and rewrite it before your application closes, if that's possible. It'll still be somewhere on the flash drive but much harder to find. But in general, if the user can read the system's RAM, all hope is lost. This belongs on IT Security, btw. – Thomas Oct 8 '12 at 0:39
  • 2
    You're attempting to solve the DRM problem, which is infeasible for a variety of reasons. Think of it as using the world's strongest lock, then putting the key under a rock in front of it. – Polynomial Oct 8 '12 at 9:07
3

One solution is to use a Smart Card rather than the flash drive: these can be arranged to perform the cryptography without letting the key go out. This works fine if speed is not an issue.

For high volume of data, you can use a random key for each file, and preppend it to the to the ciphertext, after being enciphered using the long-term key in the Smart Card, so that the Smart Card is necessary to recover the key that will decipher the file. Next step is to use asymmetric crypto in the Smart Card, and move to hybrid encryption, with the benefit that one can encipher a file for a certain user, without knowing that user's deciphering key.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.