如何安全地将公钥和私钥保存在二进制文件中？

Question

I am making a shared object that does a lots of encryption and decryption using public key and private key. I want store these keys within the binary, Is there any way to save these keys securely so that no one can use it . so How to embed a cryptographic key in a binary ?

Answer 1

If the code can access the keys, so can the users on whose machine the code is running. This is incontrovertible - there's no way around it unless you control the hardware.

Answer 2

Is there any way to save these keys securely so that no one can use it .

As millimoose said, no you can not. Or perhaps more accurately: you can not save data, any data, in a binary such that it is of use to your binary and not anyone else. While not usually discussed with this generic of a use case, this is the heart of Digital Rights Management - a desire to have some data (be it cryptographic or otherwise) that is only usable in a controlled manner.

The best you can accomplish, and this is a lot of work even for well funded and motivated organizations, would be to use the TPM to perform cryptographic operations on your behalf and in a manner that is tied to the state of the system. I'm guessing that solution isn't what you are looking for.

Answer 3

You cannot do this if you don't have control over the hardware and operating system. If you have full control, then then there is little need to add additional protection to the key. The best way of security storing keys is keeping them out of the binary . You could for instance use a secure token. This could be a TPM, a smart card or even a HSM. Those secure tokens do the cryptographic calculations on the token itself, so you never need to load it into memory.

If you want to have a very safe storage in a binary then you could take a look at this HSM . You can run your code within the HSM. Even with such a HSM, you should only generate the keys within the HSM and keep them in there. Oh, yeah, this requires you to spend several thousand dollars on an HSM...