0

I have a node.js project which implement in nest.js framework. there is some apiKey and secretKey in my env file, I want to protect these keys from anyone, even host administrator. so I compile my entire project with pkg module to a binary file but it is possible to decompile my file and extract my strings.

maybe encryption can help me but the decrypt private key must be store somewhere!

please tell me how to keep these strings safe ?

Improve this question
5
  • if your administrator have full control over the machine, your only option is to move those secrets to another machine that will proxy the request to the original web service (the evil admin can still call the service at will). Another, cumbersome, way to reduce the surface of attack is to have your app read the secrets from stdin at startup, use them to get an access token and wipe them from memory. anything else is whitebox cryptography.
    – Margaret Bloom
    Commented Aug 19 at 14:07
  • how can I implement whitebox cryptography in node js application? @margaret-bloom
    – aref razavi
    Commented Aug 21 at 8:11
  • Note that at least on Linux, the administrator root can inspect the entire environment of any process. Don’t put secrets into the environment if you don’t trust root.
    – MisterMiyagi
    Commented Sep 23 at 11:40
  • "I want to protect these keys from anyone, even host administrator." That's not possible. You can tie the encryption key to the hardware, but in order for your code to decrypt, it needs access to the key. (or to TPM) An admin could also run your code. The best you can do is secure it against an attacker who has stolen the encrypted value, but cannot execute code on the machine.
    – browsermator
    Commented Sep 25 at 17:19
  • I shouldn't say it's not possible, because you could require a user to input the key each time a decryption is needed. (so if you never store it, you don't have to protect it...)
    – browsermator
    Commented Sep 25 at 17:25

1 Answer 1

Reset to default
0

From my point of view the answer is: Don't do that at all.

The most secure way to protect sensitive information like that is to avoid embedding them directly in your code at all, even in case of a compiled binary.

Instead leverage external secure key storages. There a plenty of possible solutions in this domain out there, feel free to use the one that fits your needs best.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .