Hi,
I'm writing an app that needs to be able to decrypt files encrypted by my web server. Is there a safe way to include the private key in my compiled application so the a user/hacker will be unable to extract it from the compiled code?

Cheers

I'm no security expert, but I do know a little about programming, and a little about reverse engineering of compiled code. If your key is embedded directly in the object code, say as a static array of integers or characters, it would be possible to find and extract that array from the object code. That is not to say it would be obvious which bytes within the object module would constitute it, but it would be there. A fairly trivial second level of security would entail encrypting the key prior to compiling the source code, and then decrypting the key at runtime. This would prevent the key from being stored 'as-is' within the object code. Depending upon how you perform the runtime decryption, it may still leave the key exposed as a complete entity within a memory image, which may get created as a core dump, or other deliberate tactic used to reverse engineer your code. You may be able to defeat this approach somewhat, by having your decrypted key stored in scattered locations in memory, or by never storing the fully decrypted key at any one time.
Hope this helps, and I hope a real expert can add to this discussion.

--- rod.

Why wouldn't you use the public key in the app and have the webserver encrypt with the private key?

OP said he needs to decrypt files that have already been encrypted. Decryption requires the private key.

As theNbomr mentioned you could encrypt the private key and include it in your binary. Another option would be to store the private key in a separate keystore vault, also encrypted. You would of course need to read a key to decrypt the keystore (whether it's in executable binary, or separate). Basically your options there are to read a string from a root:root -r------- mode file, or require the operator to type in a passphrase when the application starts up (assuming it's running as a daemon).

Your approach is fundamentally flawed: you cannot "hide" a private-key anywhere and expect it not to be discovered. You have committed the cardinal sin of "security through obscurity."

You must arrange a system whereby the only key that is embedded into the application is a public one.

Otherwise, basically you are just doing "symmetric encryption in asymmetric clothing," which is just "symmetric." If that is the case, then you may as well just use DES and be done with it.

whilst i am certainly no expert, i would suggest not. i expect that with a little hard work someone could find your decryption routine, establish a breakpoint and gather the key from there.

i am curious though as to what would need a binary application to download encrypted updates and use them in a manner that cant be decrypted...