C# encrypt XML and secure it from disassembling
up vote
0
down vote
favorite
I am doing a larger application which at some point would serialize/deserialize XML files. The problem is, that I need to make some of those XML files encrypted.
Basically, the encrypted one would be made by my professor for his students. It would be like a black-box, so my professor prepares a class in my application, serializes it and additionally, my app would encrypt the whole XML. Then student loads the XML to the application, but they don't know what's in it. I thought about a simple encryption, AES, whatever. I would store the key to encryption/decryption as bytes in my code.
But then it came to me, that every student could go for something like dotPeek, or something like this, disassembly my executable and then get the key and be able to decrypt every encrypted XML file. Now that is not something I can allow.
I was searching through the internet for possible solutions to my problem, but I couldn't quite find an answer.
Can you guys think of any way of doing that kind of thing? The app would be written in C# and would be running on Windows 7/10 if that matters.
c# encryption
asked Nov 13 at 3:00
dabljues
1116
add a comment |
up vote
0
down vote
favorite
I am doing a larger application which at some point would serialize/deserialize XML files. The problem is, that I need to make some of those XML files encrypted.
Basically, the encrypted one would be made by my professor for his students. It would be like a black-box, so my professor prepares a class in my application, serializes it and additionally, my app would encrypt the whole XML. Then student loads the XML to the application, but they don't know what's in it. I thought about a simple encryption, AES, whatever. I would store the key to encryption/decryption as bytes in my code.
But then it came to me, that every student could go for something like dotPeek, or something like this, disassembly my executable and then get the key and be able to decrypt every encrypted XML file. Now that is not something I can allow.
I was searching through the internet for possible solutions to my problem, but I couldn't quite find an answer.
Can you guys think of any way of doing that kind of thing? The app would be written in C# and would be running on Windows 7/10 if that matters.
c# encryption
asked Nov 13 at 3:00
dabljues
1116
Get an ecryption key from a server
– pale bone
Nov 13 at 3:06
Not possible, as the computers in the lab may and possibly will be disconnected from the internet
– dabljues
Nov 13 at 3:16
What about just using a password the professor passes as an argument at runtime or as an environment variable, or load it from a password guarded USB stick
– pale bone
Nov 13 at 3:21
Yes, that is an option, but its kinda inconvenient
– dabljues
Nov 13 at 3:45
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
I am doing a larger application which at some point would serialize/deserialize XML files. The problem is, that I need to make some of those XML files encrypted.
Basically, the encrypted one would be made by my professor for his students. It would be like a black-box, so my professor prepares a class in my application, serializes it and additionally, my app would encrypt the whole XML. Then student loads the XML to the application, but they don't know what's in it. I thought about a simple encryption, AES, whatever. I would store the key to encryption/decryption as bytes in my code.
But then it came to me, that every student could go for something like dotPeek, or something like this, disassembly my executable and then get the key and be able to decrypt every encrypted XML file. Now that is not something I can allow.
I was searching through the internet for possible solutions to my problem, but I couldn't quite find an answer.
Can you guys think of any way of doing that kind of thing? The app would be written in C# and would be running on Windows 7/10 if that matters.
c# encryption
asked Nov 13 at 3:00
dabljues
1116
I am doing a larger application which at some point would serialize/deserialize XML files. The problem is, that I need to make some of those XML files encrypted.
Basically, the encrypted one would be made by my professor for his students. It would be like a black-box, so my professor prepares a class in my application, serializes it and additionally, my app would encrypt the whole XML. Then student loads the XML to the application, but they don't know what's in it. I thought about a simple encryption, AES, whatever. I would store the key to encryption/decryption as bytes in my code.
But then it came to me, that every student could go for something like dotPeek, or something like this, disassembly my executable and then get the key and be able to decrypt every encrypted XML file. Now that is not something I can allow.
I was searching through the internet for possible solutions to my problem, but I couldn't quite find an answer.
Can you guys think of any way of doing that kind of thing? The app would be written in C# and would be running on Windows 7/10 if that matters.
c# encryption
c# encryption
asked Nov 13 at 3:00
dabljues
1116
asked Nov 13 at 3:00
dabljues
1116
asked Nov 13 at 3:00
dabljues
1116
asked Nov 13 at 3:00
dabljues
1116
asked Nov 13 at 3:00
dabljues
1116
1116
Get an ecryption key from a server
– pale bone
Nov 13 at 3:06
Not possible, as the computers in the lab may and possibly will be disconnected from the internet
– dabljues
Nov 13 at 3:16
What about just using a password the professor passes as an argument at runtime or as an environment variable, or load it from a password guarded USB stick
– pale bone
Nov 13 at 3:21
Yes, that is an option, but its kinda inconvenient
– dabljues
Nov 13 at 3:45
add a comment |
Get an ecryption key from a server
– pale bone
Nov 13 at 3:06
Not possible, as the computers in the lab may and possibly will be disconnected from the internet
– dabljues
Nov 13 at 3:16
What about just using a password the professor passes as an argument at runtime or as an environment variable, or load it from a password guarded USB stick
– pale bone
Nov 13 at 3:21
Yes, that is an option, but its kinda inconvenient
– dabljues
Nov 13 at 3:45
Get an ecryption key from a server
– pale bone
Nov 13 at 3:06
Get an ecryption key from a server
– pale bone
Nov 13 at 3:06
Not possible, as the computers in the lab may and possibly will be disconnected from the internet
– dabljues
Nov 13 at 3:16
Not possible, as the computers in the lab may and possibly will be disconnected from the internet
– dabljues
Nov 13 at 3:16
What about just using a password the professor passes as an argument at runtime or as an environment variable, or load it from a password guarded USB stick
– pale bone
Nov 13 at 3:21
What about just using a password the professor passes as an argument at runtime or as an environment variable, or load it from a password guarded USB stick
– pale bone
Nov 13 at 3:21
Yes, that is an option, but its kinda inconvenient
– dabljues
Nov 13 at 3:45
Yes, that is an option, but its kinda inconvenient
– dabljues
Nov 13 at 3:45
add a comment |
1 Answer
1
active
oldest
votes
up vote
0
down vote
If it is a multi-user application, then you need to ensure the ownership of the file by individual user authentication & authorization.
Server should be able to validate client incoming request and serve the authorized file accordingly.
Maintain different encryption keys for each user; this is to decrypt the file. Note that, having global-admin-enc-key is vulnerable in attack vector.
To prevent the code from re-engineered, you can obscure the code by obfuscation. It confuses the code for human. This thread also claims to have a protector.
How to prevent decompilation of any C# application
answered Nov 13 at 3:16
Ashokan Sivapragasam
14611
It is a single app, which is not connected to anything whatsoever and will be copied over usb stick to multiple computers
– dabljues
Nov 13 at 3:28
You need obfuscator protector.
– Ashokan Sivapragasam
Nov 13 at 5:54
add a comment |
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
0
down vote
If it is a multi-user application, then you need to ensure the ownership of the file by individual user authentication & authorization.
Server should be able to validate client incoming request and serve the authorized file accordingly.
Maintain different encryption keys for each user; this is to decrypt the file. Note that, having global-admin-enc-key is vulnerable in attack vector.
To prevent the code from re-engineered, you can obscure the code by obfuscation. It confuses the code for human. This thread also claims to have a protector.
How to prevent decompilation of any C# application
answered Nov 13 at 3:16
Ashokan Sivapragasam
14611
It is a single app, which is not connected to anything whatsoever and will be copied over usb stick to multiple computers
– dabljues
Nov 13 at 3:28
You need obfuscator protector.
– Ashokan Sivapragasam
Nov 13 at 5:54
add a comment |
up vote
0
down vote
If it is a multi-user application, then you need to ensure the ownership of the file by individual user authentication & authorization.
Server should be able to validate client incoming request and serve the authorized file accordingly.
Maintain different encryption keys for each user; this is to decrypt the file. Note that, having global-admin-enc-key is vulnerable in attack vector.
To prevent the code from re-engineered, you can obscure the code by obfuscation. It confuses the code for human. This thread also claims to have a protector.
How to prevent decompilation of any C# application
answered Nov 13 at 3:16
Ashokan Sivapragasam
14611
It is a single app, which is not connected to anything whatsoever and will be copied over usb stick to multiple computers
– dabljues
Nov 13 at 3:28
You need obfuscator protector.
– Ashokan Sivapragasam
Nov 13 at 5:54
add a comment |
up vote
0
down vote
up vote
0
down vote
If it is a multi-user application, then you need to ensure the ownership of the file by individual user authentication & authorization.
Server should be able to validate client incoming request and serve the authorized file accordingly.
Maintain different encryption keys for each user; this is to decrypt the file. Note that, having global-admin-enc-key is vulnerable in attack vector.
To prevent the code from re-engineered, you can obscure the code by obfuscation. It confuses the code for human. This thread also claims to have a protector.
How to prevent decompilation of any C# application
answered Nov 13 at 3:16
Ashokan Sivapragasam
14611
If it is a multi-user application, then you need to ensure the ownership of the file by individual user authentication & authorization.
Server should be able to validate client incoming request and serve the authorized file accordingly.
Maintain different encryption keys for each user; this is to decrypt the file. Note that, having global-admin-enc-key is vulnerable in attack vector.
To prevent the code from re-engineered, you can obscure the code by obfuscation. It confuses the code for human. This thread also claims to have a protector.
How to prevent decompilation of any C# application
answered Nov 13 at 3:16
Ashokan Sivapragasam
14611
edited Nov 13 at 5:54
answered Nov 13 at 3:16
Ashokan Sivapragasam
14611
answered Nov 13 at 3:16
Ashokan Sivapragasam
14611
answered Nov 13 at 3:16
Ashokan Sivapragasam
14611
14611
It is a single app, which is not connected to anything whatsoever and will be copied over usb stick to multiple computers
– dabljues
Nov 13 at 3:28
You need obfuscator protector.
– Ashokan Sivapragasam
Nov 13 at 5:54
add a comment |
It is a single app, which is not connected to anything whatsoever and will be copied over usb stick to multiple computers
– dabljues
Nov 13 at 3:28
You need obfuscator protector.
– Ashokan Sivapragasam
Nov 13 at 5:54
It is a single app, which is not connected to anything whatsoever and will be copied over usb stick to multiple computers
– dabljues
Nov 13 at 3:28
It is a single app, which is not connected to anything whatsoever and will be copied over usb stick to multiple computers
– dabljues
Nov 13 at 3:28
You need obfuscator protector.
– Ashokan Sivapragasam
Nov 13 at 5:54
You need obfuscator protector.
– Ashokan Sivapragasam
Nov 13 at 5:54
add a comment |
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53273159%2fc-sharp-encrypt-xml-and-secure-it-from-disassembling%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Get an ecryption key from a server
– pale bone
Nov 13 at 3:06
Not possible, as the computers in the lab may and possibly will be disconnected from the internet
– dabljues
Nov 13 at 3:16
What about just using a password the professor passes as an argument at runtime or as an environment variable, or load it from a password guarded USB stick
– pale bone
Nov 13 at 3:21
Yes, that is an option, but its kinda inconvenient
– dabljues
Nov 13 at 3:45