I'm designing an app (for PC), that is intended to run on users' machines and generate a file with some data. The user will then upload the file to the server, and I want to verify that this file has been produced by my app and hasn't been modified. Can it be done reliably at all?
Things that I have considered:
- generating a public key on server and sending it to the app (key can be sniffed and used to sign arbitrary data)
- stream data from the app as it is generated (but still, arbitrary data can be sent)
- store secret key inside the app and use it to generate unique token (app can be decompiled and key retrieved)
App sources are planned to be open for the user, but in case there is a solution that relies on user not knowing the sources, they can be closed. There is, of course, an option to run everything completely server-side, but we are considering user-side now too.