Re: encrypted source file support in jdk?

On Thu, 27 Sep 2007 14:17:55 +0200, Tom Forsmo <tom@xxxxxxxxxx> wrote:

Hi

I an wondering if anybody knows if its possible to extend the
functionality of the sun java compiler/vm in jdk6, with for example
plugins or similar? or if the jdk supports something similar already?

What I am looking for is to set up a jdk environment where the source
code is ecrypted at the file level. This requires javac to be able to
en-/decrypt the source files. For further protection, the jvm would need
such support as well.
Encryption is a solution to a problem. Since I am not clear what your
roblen is then is is difficult for me to suggest a solution, or even
if encryption is the right solutin to your problem.

You want to protect your source files. Why? Do you have some
super-secret algorithm in your program that a competitor wants to get
their hands on?

Are you writing a virus that you want to encrypt so that it avoids
virus detectors?

Do you want to stop people copying your code and running it without
paying you?

If you are so interested in keeping your source code secret, then why
are you using Java? C++ with a highly optimising compiler will do
more to obscure the source code than any Java obfuscator.


some details:

To answer the typical question first. For this scenario I am not
interrested in encrytpted filesystems, because it still leaves the
files vulnerable as long as the filesystem is mounted. The secrecy of
the files can still be compromised from hacking, virus, trojans, skype,
xss and all other sorts of system hacking. With encrypted files the
information in the files are still protected, even in the case a trojan
sends a file by email to somebody on the internet.
No. Any piece of memory can be copied to the swap file, so in
principle anything that is in memory can also appear on disk. Since
at some point the executable byte code, and the executable machine
code, must be in memory then the level of security you seem to be
looking for is not possible.

Enctrypted filesystems only help protect the integrity of the local system and the
disk while the system/disk is not running. Encrypted files help protect
the information during use as well.

I know there are many other issues as well, I'll be working throuhg it.
here is the list of the issues of most importance:

- en-/decryption support in
- ide / editor
- compiler
- code searching tools
Do you want to encrypt your source files during development as well as
during operation?

- disassembler/debugger
- remove excess information from class files
As I said, use C++ or another compiled language instead of Java and
this problem goes away.

- how to handle static content files
- html, css, jsp, configuration files for libraries and frameworks etc
Easy enough to encrypt or obscure - anything from ROT13 to AES
depending on what you are hiding them from. ROT13 will protect from
your kid sister, AES (properly used) will protect from Nasty Megacorp
Inc.

rossum

- if class files are also encrypted
- en-/decryption support in the jvm runtime, covers tomcat, jboss etc.
- possible encrypted jar/war/ear files etc
- debugger
- information about classes must also be protected from prying
eyes who have obtained the class files and using the debugger to get
information.

.

Relevant Pages

  • Re: encrypted source file support in jdk?
    ... Encryption is a solution to a problem. ... You want to protect your source files. ... Every company has its intelectual property it wants to protect, if not then lets just open all gateways and firewalls. ... principle anything that is in memory can also appear on disk. ...
    (comp.lang.java.help)
  • Re: Securing data to a process principal
    ... reasonable controls that protect against "casual" abuse. ... hooks into your encryption function) and you cannot prevent an admin using ... The RM analyst also uses an app that has an embedded obfuscated key (I'll ... where the secret is stored in the registry. ...
    (microsoft.public.platformsdk.security)
  • Re: database password and encryption
    ... I know the basic concepts about encryption. ... This database should be encrypted with a strong, ... way you can protect the database AT ALL. ... I could encrypt the key several times and hide the new, resulting, keys on ...
    (microsoft.public.platformsdk.security)
  • Re: In Child Porn Case, a Digital Dilemma - USA
    ... and civil liberties against the government's responsibility to protect ... Department officials, meanwhile, have said that encryption is allowing ... compelling Sebastien Boucher, ... what he downloads to "clean out" the child porn, ...
    (uk.legal)
  • Encryptio key hardware solution... help :(
    ... that provides a Secure and Safe environment where these Credit Card ... Now it was proposed we do the 'hardware ... methods to protect and unprotect passed data. ... using a 2-step process the first step will need to read the encryption key ...
    (microsoft.public.sqlserver.security)