How to "hide" top-secret data that need to be fed to the app

Question

Let say I have an application that should run on a VPS. The app utilizes a configuration file that contains very important private keys, in a sense that no one should ever have access to! I know VPS providers can easily access my files . So, how may I "hide" the sensitive data from malicious acts while still have them usable for the app?

I believe encryption will be of no help, since the decryption should be done on the same machine, Also; I know running my own private server is a no-brainier, but, that's not an option. unfortunately.

Answer 1

You cannot solve this problem. Whatever workaround you can find, there will be a way for someone with access to repeat the same steps. You can only solve this if you have full control over the server (both hardware and software), otherwise, it's a lost battle.

Some links:

• https://cheatsheetseries.owasp.org/cheatsheets/Key_Management_Cheat_Sheet.html
• https://owaspsamm.org/model/implementation/secure-deployment/stream-b/
• https://security.stackexchange.com/questions/223457/how-to-store-api-keys-when-algo-trading

You can browse security SE for some direction, and ask a more target question.

This problem is mitigated with using your own servers, using specialized hardware for key storage, trusting to your host provider or cloud, and using well-designed security protocols.

Answer 2

But the VPS provider doesn't know how your app will decrypt the keys in the file? Perhaps your app has a decrypt key embedded in it, or maybe it is something even simpler. Without decompiling your app they are no closer to learning the secrets. Of course if your "app" is just a few scripts then they can work it out.

For example if the first key in the file is customerID, they don't know that all the other keys are simply xor'ed against a hash of your customerID - they don't even know the hashing algorithm you used.

Ok, that might be too simplistic of you used one of the few well known hashes, but if there are only a few clients, it can be enough.

Obviously, they could be listening to the network traffic your app is sending, but then that should be end-to-end encrypted already, if you are that paranoid.