C# Application cracking

Question

we have created an application like adobe reader to read a special encrypted document file format which does recognize only by our application.

what we want to do is to let user buy the application using his/her account from a website & after that we'll let him/her download that document using this program and start reading it.

here is our concerns:

1) document files should not be read in another user computer which means if user1 gives the raw downloaded file to user2 which has our application in his/her own computer the second user must not be able to read that file

2) after users download their files, they can just read those file offline (not constantly be online to be able to read)

3) this security must not break down easily because these document data are vital & the user information & application must not be hacked and cracked !

4) maybe later we want to have our android/IOS version so the solution must be cross platform

5) solution like providing login mechanism for each document won't work because users are able to give the copy of their own files together with their username & password to other users.

6) file encrypting mechanism must not break down by crackers so that they just decrypt the document & post the free version all around the internet

Do you have any programming method, security mechanism or suggestion ?

Answer 1

You could use public-key (or asymmetric) cryptography. You encrypt the document with the public key of the user. Then only people with access to the private key (ideally: only the user) can decrypt it.

However if the user has access to his own key (and he should), nothing can keep the user from decrypting the document and sharing it with others (or sharing his private key with others).

In the end: if a user, or the program needs access to the unencrypted product and the user has no interest in keeping the document secure, confidentiality can and - if the product is interesting enough - will be broken.

Answer 2

This is the problem with .NET it's easily reversed, because of the executables having a lot of meta data stored and that it does not compile to native (asm), but to IL. Your best bet would be to use an obfuscator and something like .NET Seal (However if I am correct it requires the users to be on the net) http://forum.elitevs.net/

Again you want to go cross platform and for C# to do that you'll have to use something like Mono: http://www.mono-project.com/Main_Page

Although that would require the end user to also have mono.

Now to answer your "points".

1) Make each file and application share some sort of encryption that is unique to each file and application, making sure that the file only matches for the application one user have ex.

User X downloads the application. User Y downloads the application.

Both downloads are unique with some sort of encryption algorithm or encryption key.

User X downloads Document A. Document A will be sharing the same algorithm / key as User X's application which makes it unique to him only.

User X gives Document A to User Y. As User Y's application does not share the same algorithm / key as User X then the Document is not readable.

2) I will referre to what I said first in my answer.

3) I will referre to what I said first in my answer.

4) I will referre to what I said first in my answer. However I want to point out that it's not entirely a bad idea, but it's something that should be taken into consideration if C# really is the language of choice for this.

5) I will reffere to answer #1 here.

6) I will reffere to answer #1 here.

Answer 3

If you are going to allow the user to download the file, then there is going to be no way to 100% secure it. The reason is, there must be a way to decrypt it so that the user can read it. This decryption process must occur on the user's machine, since the program to read it will have to decrypt it and open it on their machine.

Once the program to decrypt it is running on the user's machine, he can reverse engineer it and hack it (assuming he's clever enough).

That being said, there are many way to make it difficult to crack your decryption. Now if you take away the ability to read offline, you have more control. A hacker cannot run a disassembler or decompiler on your remote server.

Hope this info helps