0

I and a friend are developing a web game. The front-end to back-end communication will be carried out by the means of an API.

We realized that someone could then easily hook up to our API and make a clone that uses our API.

So we googled a bit and found out about HMAC signatures. While it sounds great, how could we protect its key that is embedded in the code from someone who would just copy the entire source and make slight visual modifications?

How could we do this in a better way? Is there a way of implementing the key code that is copy proof? Or maybe we should use a completely different approach (because I am not so sure if embedding the key in the code itself is that smart)?

Sources:

https://softwareengineering.stackexchange.com/a/369938

https://security.stackexchange.com/a/20301

https://www.approov.io/blog/simple-app-authentication.html

https://en.m.wikipedia.org/wiki/HMAC

migrated from crypto.stackexchange.com Jul 7 at 20:21

This question came from our site for software developers, mathematicians and others interested in cryptography.

  • 2
    You are trying to implement DRM. That's a whole topic onto itself, as is key management. If you simply want to keep it out of source code then you could replace a test key file with a key file during application creation. – Maarten Bodewes Jul 7 at 20:18
  • 1
    Short answer: You can¨t really protect yourself from that. There is no way for your server to know if the client that is connecting is running your original source, something modified, or something completely different. There might be clever ways to make it harder to fiddle with the game, but you will not be able to make it impossible. – Anders Jul 7 at 20:25
  • 1
    You want to do what even Niantic was unable to do and custom Pokemon-Go clients keep popping up and down... – ThoriumBR Jul 7 at 20:54
0
  1. You don't embed the key in the source code. Your code should make an request to the server, then server responds with a token authenticated with the "server-side" key using HMAC.

  2. When your server responds to requests, it should check the HTTP Referer or Origin header (which ever exists), and if it doesn't match the address of your server, you reject the request.

  3. Consider setting up user login system if possible, and use captcha or some proof-of-work; and only serve requests to registered users.

  • Thanks a lot for your answer! Using an HTTP Referer sounds like what we are looking for. I didn't quite understand nr 1 unfortunately. Could you elaborate, please? – Tomas Jul 11 at 7:37
0

I did very similar project before. I assume your source code will be distributed to 3rd party as open-source or obfuscated open source.

Let me explain in two conditions:

  1. If you do not store the key in the source code

    This solution is similar as DannyNiu's answer above. Receive the key from server only when need the key. It can enhance the security in some aspect. The disadvantage is that, in real application environment, the key must be stored locally for many reasons.

  2. If you store the key in the code

    The people have your code can be static and dynamic code analysis to retrieve the key. Thus, you need the code protection methods. For example:

    2a. Code obfuscation

    There are many code obfuscation projects available online, such as ollvm. The objective is to make the code algorithm not human readable. It can prevent static code analysis efficiently. But people can still read variable values through dynamic debug. The challenge is to decide which parameter's value is the key value.

    2b. white-box cryptography

    The key is still stored in the code, but not the normal format. The key hides in a crypto table (at least hundreds of kbs). The whole table is the key. For example, white-box AES and github project here. You input the ciphertext/plaintext to the tables and receives the plaintext/ciphertext. The value is exactly same as standard AES. Reverse engineering the key from tables is challenging. You can google more on this. For example, static white-box and dynamic white-box cryptography.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.