How to protect encryption key while application is using it

Question

I made an J2SE application that uses AES (in CBC mode using BouncyCastle library) to encrypt application config file & some user provided files.

I stored the raw AES key in a file that is stored on a flash drive. To use the application the flash drive should be plugged to machine first. Users doesn't have physical access to the port that flash drive it connected to.

But the problem is: How about copying KEY file or opening it using an HEX editor & writing bytes on a paper?

How Can I protect key file against copying (by the file or visually)?

Note: I thought about loading the key into RAM and forcing the user to unplug the flash drive but this only decreases the time for copying the key.

Answer 1

One solution is to use a Smart Card rather than the flash drive: these can be arranged to perform the cryptography without letting the key go out. This works fine if speed is not an issue.

For high volume of data, you can use a random key for each file, and preppend it to the to the ciphertext, after being enciphered using the long-term key in the Smart Card, so that the Smart Card is necessary to recover the key that will decipher the file. Next step is to use asymmetric crypto in the Smart Card, and move to hybrid encryption, with the benefit that one can encipher a file for a certain user, without knowing that user's deciphering key.