I am writing an Android app with AES encryption and I am going to save AES key as a string to a C++ file with extension .cpp.

I am also going to create an iOS app which will use the same AES key. Is it possible to save the key in C++ file in iOS? How difficult would it be to decompile the C++ file and read the key?

Here is the C++ file from Android:

#include <jni.h>
#include <string>

extern "C"
JNIEXPORT jstring JNICALL
Java_com_android_app_aesKeyFromJNI(JNIEnv *env, jobject /* this */) {
    std::string secret = "somesecretkey";
    return env->NewStringUTF(secret.c_str());
}
  • 16
    A plain ascii string is anything but secret. – joxeankoret Nov 7 at 14:13
  • 5
    Any reason not to use the Android keystore system which is explicitly made for this purpose? – Damon Nov 7 at 16:38
  • 1
    No need to decompile. There is a piece of software called "strings" (typically installed or available to unixen like Linux and Mac OS) that will dump all strings in your app. All I have to do is to test the strings one-by-one until I find the correct secret key. Obviously I'd skip strings like "Thank You." and "Login:" – slebetman Nov 8 at 3:29
  • 1
    You don't talk about compiling this C++ file anywhere. The C++ file already is plain text. I think you're talking about distributing an object file or library compiled from this .cpp, but that's not what you wrote in the question, you just keep talking about the C++ source. – Peter Cordes Nov 8 at 8:19
  • 4
    @slebetman Next time I shall make my keys "Thank You." or "Login:" and they will be safe! – Lightness Races in Orbit Nov 8 at 12:38

Not hard enough!

First of all, if you save the key as a non-encrypted string, a simple strings command will find it and IDA x-ref will even show the reverser where it's used.
If you save the key encrypted, a simple breakpoint will let them see the decrypted password. (or understanding the decryption algorithm).

  • "or understanding the decryption algorithm" Shouldn't be understanding the algorithm be irrelevant to breaking it? At least in well-designed encryption I thought that was kind of a design standard – Hobbamok Nov 8 at 9:40
  • 3
    @Hobbamok My point was that if you return the secret, you need to decrypt it. The algorithm and password for the decryption will be written. A reverser could simply extract those and decrypt yhe original secret – Amirag Nov 8 at 10:44

A plain text string like this will be visible by looking at the file in a hex editor (like hte or a viewer like xxd or od) or with the Sysinternals strings command or with strings(1) on a Linux/FreeBSD etc, for example. Most reverse engineering tools have a separate view for strings, because those are usually exceptionally useful to reverse engineers. Amirag already pointed that out for IDA.

In terms of Android that C++ file is likely going to end up as a shared object in ELF file format. These are binary files with a known structure. Simply by looking at the exported functions/symbols, it will be trivial to find the "secret". Even if you were to obfuscate this further, it would still not help. Obfuscation is security through obscurity. It's not actual security. So even writing that string as some xor-ed array of bytes or using the Caesar cipher will add no tangible protection if that's the goal.

Furthermore you should never ever include the private key in code that ends up with the user. The reason why it's called a secret is because it should be kept secret. Just "mangling" the representation of this secret with a compiler isn't going to help at all.

If it's a secret the user shouldn't see, this belongs on the server-side or into a HSM (hardware security module), but not on the user's machine in any form. There is no other way to reconcile mistrusting the user and at the same time placing "secrets" into the user's hands. It's the fundamental conundrum of software protection mechanisms also.

  • Can a user see the string if they open the file in Notepad? Because ten-year-olds will try that. – Robyn Nov 8 at 7:12
  • @Robyn: In theory, yes. However, if you mean Windows Notepad, that has typically huge problems with Unix line breaks and besides, there's no telling how many line breaks there are anyway in a binary. So the text may appear in one long line. That said, if your ten-year-old knows to turn it on, they can make use of the Word Wrap feature to mitigate that problem to some extent. – 0xC0000022L Nov 8 at 8:16

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.