3

I wrote an C# WPF application that signs a license xml file using the standard .Net SignedXml class. I am able to extract the public and private key as xml strings. I can safely tuck away my private key locally for the signing application, but what about the public key needed in the remote sign check application (library)? Options considered:

  • KeyContainer: no good, because signing and checking happens in 2 separate environments
  • Hardcoded: hardcode the public key as xml string in my checking library. I know the public key is not secret, but how can I prevent hackers from replacing the key with their own? I can sign the library, but then they could tamper with the application using the library....
2
  • A quick search of pirate bay will tell you there is no such things as a crack proof app. What you have to do is strike a balance between how much time you put in making it more difficult to crack versus the likely hood of someone bothering to try. Lots of people would go to great lengths to crack Windows but how much effort would someone go to for your application. Jun 27, 2012 at 12:04
  • So true.. I've been around long enough to agree. Copy II PC anyone? :)
    – Nerwi
    Jun 27, 2012 at 12:13

2 Answers 2

3

Put the public key in a standard digital certificate that you distribute with your app. The integrity of the certificate will then be guaranteed by Windows, and you can tell if it's been changed.

Of course both the hardware and Windows itself is under the control of any potential attacker, so you can't really prevent a compromise of a specific machine.

Here's an example from a program that I used to distribute. When the program was activated from a licence perspective, it sent a hardware hash to a web service. This returned a self-signed certificate containing the hardware hash, which my program then checked whenever it was started. If the certificate had been changed in any way, the program would stop.

3
  • I'm not all that familiar with digital certificates. I'll have to do some research on that. Seems like if the windows system is comprised, a whole lot of application certificates are comprised.
    – Nerwi
    Jun 27, 2012 at 12:31
  • Well you cannot trust code you run on an untrusted machine, period. You can however mitigate the risks. An OS is less easily compromized than e.g. a user account. Even then, the answer of RoadWarrior is, if not plain wrong, at least a few explanations short. Jun 27, 2012 at 21:46
  • @owlstead, I would be grateful if you could improve my answer or explain where you think it could be improved.
    – HTTP 410
    Jun 28, 2012 at 9:23
1

I put the public key in a directory outside of the inetpub directory, and if you move the private key off of the computer, then the worst someone could do is to replace the public key and it no longer can decrypt, but you could be informed when it can't decrypt to know something happened.

But, if someone was able to change your file you will have bigger problems that just having this one file changed.

UPDATE:

Oops, I missed that this is a WPF program. Unfortunately the best you can do is to have the private key separate from the public key, so, you can decrypt, but if the hacker changes the public key the application won't function properly.

That is one of the advantages of using the public/private key, to verify that only you can do the encryption.

The other option is to fetch the public key from a webserver, but then you have the same problem in that it is possible for someone to trick the application to go to the wrong server, so it isn't full-proof, and it will require that the user had an Internet connection, and for you to uniquely identify them.

2
  • inetpub? I am not talking about a webapplication here. I want to prevent to prevent that hackers can sign with their own private key and replace my public key with theirs.
    – Nerwi
    Jun 27, 2012 at 12:04
  • @Nerwi you simply cannot trust any keystore on places where you cannot trust your own code to run without compromise. Having your code run properly is a prerequisite for placing trust in your application. So you might as well distribute your public key as a resource within your application. Jun 27, 2012 at 21:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.