What cryptographic protocol is appropriate for the case where user needs access to a binary and encrypted configuration files?

Question

This is a very newbie IT security question...

I have to quickly implement a solution for our application that works like this... We have a binary executable that is given a configuration file. I need to encrypt the configuration file such that a non-trusted user can be given the binary and the encrypted config file (and maybe a public key or something) and he should be able to run the binary with the encrypted file.

Could you suggest a cryptography paradigm &/or c++ crypto library that will allow me to do the above? I was thinking of encrypting the config files with a static blowfish key which is hard-coded into the binary as an urgent fix which will raise the bar ever so slightly based on advice I got from the crypto stack exchange.

What would be a good design in the long run? I'm looking towards protecting from the following problems :-

1. Casual reading of the xml configuration/input files
2. Easy disassembling and reverse engineering of the binary / extraction of the secret key by searching through the text or data section
3. some other attack vectors that you can think of just so that I know?

Note :- Question reposted from crypto stack exchange since this is probably a better place to ask it.

Answer 1

If you store a key, password, etc. in the source code you will never be able to reasonably expect to keep it secret unless you also control the system. What you are describing would only be obscurity, obfuscation, or data hiding.

If you want only the program to be able to decrypt, its sounds like a case for using asymmetric cryptography. You may have a scenario where you encrypt the actual data using a symmetric key, but transfer the symmetric key using asymmetric to reduce overhead.

Depending upon your scenario, you could implement an Hardware Security Module (HSM). If you can setup and control the system, the HSM would be the trusted source to hold your secrets and protect the decryption process from the system and application. However, if you do not have physical control then the customer could possibly tamper with the HSM.

If the decryption keys are in the app or stored at the system, and the system is not under your control - the person who controls the system can always access them somehow, you can make it difficult, but not impossible. If you have complete control of the system, you can limit the user privileges to prevent them from loading tools or even reading the files to some degree. However, with a compiled desktop application being shipped to a customer, you will never be able to ensure they can't reverse or find the secrets.

Answer 2

IMO, on desktop applications that use binary + xml configuration you can never be sure your xml is not being read, using a tool like Ollydbg its fairly easy to obtain any encryption key you might place in the binary. I would suggest if possible you look into deploying your application in a virtual environment like citrix, which if properly configured will give access tot he users only to the application and nothing else.