0

I and a friend are developing a web game. The front-end to back-end communication will be carried out by the means of an API.

We realized that someone could then easily hook up to our API and make a clone that uses our API.

So we googled a bit and found out about HMAC signatures. While it sounds great, how could we protect its key that is embedded in the code from someone who would just copy the entire source and make slight visual modifications?

How could we do this in a better way? Is there a way of implementing the key code that is copy proof? Or maybe we should use a completely different approach (because I am not so sure if embedding the key in the code itself is that smart)?

Sources:

https://softwareengineering.stackexchange.com/a/369938

https://security.stackexchange.com/a/20301

https://www.approov.io/blog/simple-app-authentication.html

https://en.m.wikipedia.org/wiki/HMAC

3
  • 2
    You are trying to implement DRM. That's a whole topic onto itself, as is key management. If you simply want to keep it out of source code then you could replace a test key file with a key file during application creation. Jul 7, 2019 at 20:18
  • 1
    Short answer: You can¨t really protect yourself from that. There is no way for your server to know if the client that is connecting is running your original source, something modified, or something completely different. There might be clever ways to make it harder to fiddle with the game, but you will not be able to make it impossible.
    – Anders
    Jul 7, 2019 at 20:25
  • 1
    You want to do what even Niantic was unable to do and custom Pokemon-Go clients keep popping up and down...
    – ThoriumBR
    Jul 7, 2019 at 20:54

2 Answers 2

1

I did very similar project before. I assume your source code will be distributed to 3rd party as open-source or obfuscated open source.

Let me explain in two conditions:

  1. If you do not store the key in the source code

    This solution is similar as DannyNiu's answer above. Receive the key from server only when need the key. It can enhance the security in some aspect. The disadvantage is that, in real application environment, the key must be stored locally for many reasons.

  2. If you store the key in the code

    The people have your code can be static and dynamic code analysis to retrieve the key. Thus, you need the code protection methods. For example:

    2a. Code obfuscation

    There are many code obfuscation projects available online, such as ollvm. The objective is to make the code algorithm not human readable. It can prevent static code analysis efficiently. But people can still read variable values through dynamic debug. The challenge is to decide which parameter's value is the key value.

    2b. white-box cryptography

    The key is still stored in the code, but not the normal format. The key hides in a crypto table (at least hundreds of kbs). The whole table is the key. For example, white-box AES and github project here. You input the ciphertext/plaintext to the tables and receives the plaintext/ciphertext. The value is exactly same as standard AES. Reverse engineering the key from tables is challenging. You can google more on this. For example, static white-box and dynamic white-box cryptography.

1
  • white-box cryptography is fascinating. thanks for the info Sep 6, 2019 at 5:39
0
  1. You don't embed the key in the source code. Your code should make an request to the server, then server responds with a token authenticated with the "server-side" key using HMAC.

  2. When your server responds to requests, it should check the HTTP Referer or Origin header (which ever exists), and if it doesn't match the address of your server, you reject the request.

  3. Consider setting up user login system if possible, and use captcha or some proof-of-work; and only serve requests to registered users.

3
  • Thanks a lot for your answer! Using an HTTP Referer sounds like what we are looking for. I didn't quite understand nr 1 unfortunately. Could you elaborate, please?
    – Tomas
    Jul 11, 2019 at 7:37
  • @DannyNiu #1 is a great option, however, how do you protect/secure the call to get the HMAC secret that will be used to sign your future calls? Seems like a chicken and egg situation, you have to hard code something to get the ball rolling or what am I missing? How do you protect the request to get the HMAC secret basically? May 28, 2021 at 21:33
  • @RodneyS.Foley I just assumed users have to login somehow.
    – DannyNiu
    May 29, 2021 at 1:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .