How do you hide secret keys in code?

encryption obfuscation
TTar picture TTar · Apr 18, 2009 · Viewed 35.5k times · Source

I've wondered for some time how some software hides secret keys in such a way that they can't be trivially discovered. Just a few examples:

  • DVD Player Software hides CSS keys
  • Software with serial numbers/registration codes hides keys/hashes used to validate the serial numbers

Obviously, these programs do something more than just have the key in a byte[], as that would make it easy to steal their keys and generate your own serial numbers, etc.

What sorts of strategies are used to hide these keys so that they can't be found easily?

Answer

Michael picture Michael · Apr 18, 2009

The reasons those secret keys were so easily discovered is because they were hidden in software.

Avoid hiding secrets in software at all cost - obfuscation will only get you so far. Ask yourself this: How well can I hide a key in software from someone with full access to the disassembly, user mode and kernel mode debuggers, and no day job? It's only a matter of time before it gets cracked.

Related questions

How can I hide or encrypt JavaScript code?

Is there any way to hide or encrypt JavaScript code to prevent people from viewing, copying, and/or modifying proprietary programs?

Read More
Best solution to protect PHP code without encryption

First of all, I'm not looking for miracle... I know how PHP works and that there's not really way to hide my code from the clients without using encryption. But that comes with the cost of an extension to be …

Read More
Is it possible to hide/encode/encrypt php source code and let others have the system?

Is it possible to hide/encode/encrypt the php file/source code, and let others have the system installed and run on their machine?

Read More