How to protect HMAC key embedded in code from someone who would copy entire source?

Question

I and a friend are developing a web game. The front-end to back-end communication will be carried out by the means of an API.

We realized that someone could then easily hook up to our API and make a clone that uses our API.

So we googled a bit and found out about HMAC signatures. While it sounds great, how could we protect its key that is embedded in the code from someone who would just copy the entire source and make slight visual modifications?

How could we do this in a better way? Is there a way of implementing the key code that is copy proof? Or maybe we should use a completely different approach (because I am not so sure if embedding the key in the code itself is that smart)?

Sources:

https://softwareengineering.stackexchange.com/a/369938

https://security.stackexchange.com/a/20301

https://www.approov.io/blog/simple-app-authentication.html

https://en.m.wikipedia.org/wiki/HMAC

Answer 1

I did very similar project before. I assume your source code will be distributed to 3rd party as open-source or obfuscated open source.

Let me explain in two conditions:

1. If you do not store the key in the source code

   This solution is similar as DannyNiu's answer above. Receive the key from server only when need the key. It can enhance the security in some aspect. The disadvantage is that, in real application environment, the key must be stored locally for many reasons.

2. If you store the key in the code

   The people have your code can be static and dynamic code analysis to retrieve the key. Thus, you need the code protection methods. For example:

   2a. Code obfuscation

   There are many code obfuscation projects available online, such as ollvm. The objective is to make the code algorithm not human readable. It can prevent static code analysis efficiently. But people can still read variable values through dynamic debug. The challenge is to decide which parameter's value is the key value.

   2b. white-box cryptography

   The key is still stored in the code, but not the normal format. The key hides in a crypto table (at least hundreds of kbs). The whole table is the key. For example, white-box AES and github project here. You input the ciphertext/plaintext to the tables and receives the plaintext/ciphertext. The value is exactly same as standard AES. Reverse engineering the key from tables is challenging. You can google more on this. For example, static white-box and dynamic white-box cryptography.

Answer 2

1. You don't embed the key in the source code. Your code should make an request to the server, then server responds with a token authenticated with the "server-side" key using HMAC.

2. When your server responds to requests, it should check the HTTP Referer or Origin header (which ever exists), and if it doesn't match the address of your server, you reject the request.

3. Consider setting up user login system if possible, and use captcha or some proof-of-work; and only serve requests to registered users.