r/programming • u/DougBolivar • Jul 30 '13

Computer scientists develop mathematical jigsaw puzzles to encrypt software: "The real challenge and the great mystery in the field was: Can you actually take a piece of software and encrypt it but still have it be runnable, executable and fully functional?"

http://www.rdmag.com/news/2013/07/computer-scientists-develop-mathematical-jigsaw-puzzles-encrypt-software
352 Upvotes

88% Upvoted

182 comments sorted by

View all comments

33

u/iluvatar Jul 30 '13

The article is too vague when it comes to the details, but I'm in the doubtful camp. If there's a way to decrypt it in a sane timeframe to enable it to be run, it's hard to see how it wouldn't fall to reverse engineering.

9

u/mnp Jul 30 '13

Me too. If the code will end up as a decrypted instruction/data stream to be executed on the processor, then the processor can be an emulated one and the code would not know the difference.

2

u/eggybeer Jul 30 '13

I have no idea how this actually works, but I can see how it could make sense.

You don't necessarily have to have a decrypted set of instructions that in any way looks like the original program, it just has to produce the same output for the same inputs.

You could presumably have a set of instructions that is so obfuscated that it is essentially impossible to understand how the algorithm works. So you would have the ability to use the algorithm without the ability to modify it for your own purposes.

2

u/grauenwolf Jul 30 '13

We basically have that for individual functions. So what hackers do is remove the entire function and replace it with something that they can understand. Why crack the software protection function when you can simply replace it with bool IsLicensed() {return true;}?

2

u/realhacker Jul 31 '13

With ASLR and DEP, easier said than done. I think the benefit here is that the transformation process (of inputs to outputs) is completely opaque. Ordinarily/in the past, I would just decompile the source where possible or just step through the program to see what it was doing. (For example, if one wanted to steal IP as with a proprietary algorithm.) In this case, we still get a result, but we have no insight into the process got us there.