0

I have a Python 3 program, and I’m having trouble finding an encryption method that will suit my needs.

Suppose the program is on a thumb drive. I would give the thumb drive to someone else, and they will run it. It will ask them to input a number, and then close.

When it closes, two files are made. An encryption key and an encrypted file that contains their number.

They give the thumb drive to someone else. This person runs the program and inputs a number. The programs decrypts the secret file, checks if the inputted number is < or > the secret number, and displays a message depending on the conditions.

The problem is, the private key is stored alongside the secret file, and I don’t want anyone to be able to read the key file and use it to decrypt the secret file.

Is there an encryption method that will ensure the file is not compromised?

Improve this question
0

2 Answers 2

Reset to default
4

Every encryption method relies on a secret which is not known to the attacker, i.e. either the encryption algorithm itself is secret or (more common) the algorithm is known but is parameterized using a secret like a password or key.

In your case the attacker has access to both the algorithm and to the key, which means nothing is secret to the attacker. In such scenario encryption will not help, since the attacker has everything needed to decrypt.

You might try to have the secret key or the full encryption/decryption process external, but then you would need to limit access to this external process using some kind of authentication - which relies on yet another secret and thus will not help.

Or you might try to obfuscate your program as much as possible so that the attacker is unable to crack your encryption algorithm/key with acceptable cost. This might be feasible if the gain for the attacker is low, but the larger the possible profit the more effort the attacker will invest in deobfuscating your code.

In general: if all the information is contained in your code, then you need to limit what the user can do with you code, like preventing or significantly hinder inspection and debugging. If the code relies on some device specific secret like a file containing the key, then you need to limit what the user can do with their own device. As long as noch such limitations can be done you are out of luck. This is the same problem one has with DRM or with a locally stored state in games.

Improve this answer
1
  • It seems I may be out of luck with my program :( Obfuscation won’t work because the possible profit is intended to be huge. Thank you.
    – Cannabijoy
    Aug 6, 2022 at 10:19
2

What you seem to be looking for is homomorphic encryption.

How it works is beyond a security post but it allows one person to encrypt something and someone else to perform limited computation on the encrypted value without ever knowing it's value.

An equality condition would probably violate the intention of these protocols (because it necessarily indicates the actual value) but I believe it to be possible.

Improve this answer
2
  • Thank you. I looked into homomorphic encryption, and I don’t really understand it. I know you can do addition and multiplication to the numbers, so it seems like you could just +1 and figure out what the number is. I’m sure there’s got to be something I’m misunderstanding. However, if that is possible and I could store the new number in a variable, that would probably work.
    – Cannabijoy
    Aug 6, 2022 at 23:37
  • The security of the answer depends on how one phrases the question. I want to say Z-cash uses it to verify no coins are created or destroyed during an operation without verfiers knowing how much money is moving around or who is involved. Like I said, equality condition betrays the security but the participant couldn't know the value before making a guess.
    – foreverska
    Aug 7, 2022 at 18:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .