-1

I am wondering what are the possible options for the following: Let's say you have a software-agent you want to deploy on systems running both on Windows and Linux, e.g. an agent written in C++. Let's say this agent uses certificates issued by a PKI to do authentication towards a centralised system, be it locally or in the cloud (for TLS with mutual authentication).

How would you go about storing those client certificates for the agents in a secure way on both operating systems?

Just putting those certificates somewhere on the filesystem is obviously a no-go. Embedding them in the software agent itself is also to be considered dangerous, since anyone who has access to the system can grab the agent and reverse-engineer it, trying to extract the certificate from the agent.

So how would you protect those certificates in a secure way on third-party systems that are not under your control?

Improve this question
2
  • 2
    If your theoretical attacker is able to reverse-engineer the binary to pull the certificate out, then they'll be able to get the certificate no matter what you do. They probably won't even need to do that since they can just run the program and read the certificate directly out of memory, so even if you encrypt it they'll be able to access it eventually.
    – user
    Nov 4, 2020 at 15:23
  • 2
    You're essentially asking how to implement DRM. It is impossible. Also from a simple networking perspective, certificates are sent in plain text over the wire.
    – user163495
    Nov 4, 2020 at 15:25

1 Answer 1

Reset to default
1

What you want to do is essentially impossible.

You want the user to hold onto a certificate and its associated private key, but without ever letting the user see the private key or certificate. This is not possible, since the user is in full control of the machine. They could read the private key whenever it is being touched, meaning when it's written to disk, loaded into memory, etc...

The certificate, aside from it not needing to be private, would be even less secure. Why? Because the certificate is sent over the wire during the TLS handshake. Here is a Wireshark dump of me connecting to stackexchange.com :

Wireshark Dump of the Stackexchange Certificate

So not just the user could "steal" the certificate, but also anyone listening on the same network.

But isn't there a way?

Kind of and no. If you want users to be able to use their own hardware, then no. If you are willing to create your own hardware - think of game consoles and smart phones - then it becomes substantially more difficult. In such locked-down environments, it is more difficult but not impossible. In essence, you need to check whether maintaining your own platform is worth the cost - it likely isn't.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .