<?xml version="1.0" encoding="utf-8"?>
<feed xmlns="http://www.w3.org/2005/Atom" 
      xmlns:thr="http://purl.org/syndication/thread/1.0">
  <link rel="alternate" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html" />
  <link rel="self" type="application/atom+xml" href="http://www.insideria.com/atom.xml" />
  <id>tag:www.insideria.com,2009://34/tag:www.insideria.com,2008://34.23249-</id>
  <updated>2009-11-16T15:48:24Z</updated>
  <title>Comments for Encryption in Flex Applications 2 - SWC AS3 Library Encryption (http://www.insideria.com/2008/04/encryption-in-flex-application-1.html)</title>
  <generator uri="http://www.sixapart.com/movabletype/">Movable Type 4.21-en</generator>
  <entry>
    <id>tag:www.insideria.com,2008://34.23249</id>
    <link rel="alternate" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html" />
    <link rel="service.edit" type="application/atom+xml" href="http://blogs.oreilly.com/cgi-bin/mt/mt-atom.cgi/weblog/blog_id=34/entry_id=23249" title="Encryption in Flex Applications 2 - SWC AS3 Library Encryption" />
    <published>2008-04-02T15:30:00Z</published>
    <updated>2008-04-02T15:38:44Z</updated>
    <title>Encryption in Flex Applications 2 - SWC AS3 Library Encryption</title>
    <summary>In this article, we&#8217;ll go over an example using Interfaces, Factories, and Encryption to protect code in a SWC library from being easily decompiled.</summary>
    <author>
      <name>Andrew Westberg</name>
      <uri>http://www.flexjunk.com</uri>
    </author>
    
    <category term="Blogs" />
    
    <content type="html" xml:lang="en" xml:base="http://www.insideria.com/">
      <![CDATA[<p>
In article 1, I showed a trivial example of using the AS3Crypto API for encrypting data.  In this article, we&#8217;ll go over an example using Interfaces, Factories, and Encryption to protect code in a SWC library from being easily decompiled.
</p>

<div class="ap_r" style="margin: 16px;"><a href="http://www.insideria.com/upload/2008/03/encryption_in_flex_application_1/article2_img1.png" class="highslide" onclick="return hs.expand(this)"><img src="http://www.insideria.com/upload/2008/03/encryption_in_flex_application_1/article2_img1.png" alt="article2_img1.png" title="Click to enlarge" width="148"/></a></div>
<p>
The first order of business is to create a Flex Library project to hold our protected code, and another Flex Library project to hold the Interface and Factory to access it.  In this case, our <strong>super-duper-ultra-mega-secret</strong> code we want to protect is how to calculate the circumference and area of a circle.  I&#8217;ve created projects called CircleCalculator and CircleCalculatorInterface.  CircleCalculator should reference CircleCalculatorInterface so we can implement the interface we&#8217;ll create.
</p>

<p>
In CircleCalculatorInterface, create an Interface class to define what we want our end-user to be able to do.  We&#8217;re hiding the code because we don&#8217;t want them to be able to decompile our code to see how circle areas and circumferences are calculated.
</p>
<div class="acode" style="overflow: auto; padding: 10px;" ><div style="overflow-x: visible;"> 
<code language="perl">
<pre> 
package com.company
{
 	<span class="category1">public</span> <span class="category1">interface</span> ICircleCalculator
 	{
  		<span class="category1">function</span> calcArea(radius:<span class="category2">Number</span>):<span class="category2">Number</span>;
  		<span class="category1">function</span> calcCircumference(radius:<span class="category2">Number</span>):<span class="category2">Number</span>;
  	}
}</pre>
</code>
 
</div></div> 

<p>
Next, in CircleCalculator, create our <strong>super-duper-ultra-mega-secret</strong> code that implements the ICircleCalculator interface.
</p>
<div class="acode" style="overflow: auto; padding: 10px;" ><div style="overflow-x: visible;"> 
<code language="perl">
<pre> 
package com.company
{
 	<span class="category1">import</span> com.company.ICircleCalculator;
 	
 	<span class="category1">public</span> <span class="category1">class</span> CircleCalculator <span class="category1">implements</span> ICircleCalculator
 	{
  		<span class="category1">public</span> <span class="category1">function</span> CircleCalculator()
  		{
   		}
  		
  		<span class="category1">public</span> <span class="category1">function</span> calcArea(radius:<span class="category2">Number</span>):<span class="category2">Number</span>
  		{
   			<span class="category1">return</span> <span class="category2">Math</span>.<span class="category2">PI</span> * radius * radius;
   		}
  		
  		<span class="category1">public</span> <span class="category1">function</span> calcCircumference(radius:<span class="category2">Number</span>):<span class="category2">Number</span>
  		{
   			<span class="category1">return</span> 2 * <span class="category2">Math</span>.<span class="category2">PI</span> * radius;
   		}
  	}
}</pre>
</code>
 
</div></div> 

<div class="ap_r" style="margin: 16px;"><a href="http://www.insideria.com/upload/2008/03/encryption_in_flex_application_1/article2_img2.png" class="highslide" onclick="return hs.expand(this)"><img src="http://www.insideria.com/upload/2008/03/encryption_in_flex_application_1/article2_img2.png" alt="article2_img2.png" title="Click to enlarge" width="148"/></a></div>
<div class="ap_r" style="margin: 16px;"><a href="http://www.insideria.com/upload/2008/03/encryption_in_flex_application_1/article2_img3.png" class="highslide" onclick="return hs.expand(this)"><img src="http://www.insideria.com/upload/2008/03/encryption_in_flex_application_1/article2_img3.png" alt="article2_img3.png" title="Click to enlarge" width="148"/></a></div>
<p>
Now that we have the CircleCalculator project in a state that is compiling, open up the bin folder and extract library.swf from CircleCalculator.swc using the zip tool of your choice.  Then copy library.swf to the root folder of CircleCalculatorInterface.  Library.swf contains the actual code that we&#8217;re going to be encrypting.
</p>
<p>
In order to encrypt library.swf, I&#8217;ve created a tool called LibraryEncrypter as an AIR application.  It takes any dropped file and encrypts it using blowfish.  The key is stored at the beginning of the encrypted bytes.  In a real-world scenario, you&#8217;d obviously want to do more obfuscation of the key or store it server-side for increased protection.
</p>
 <div class="acode" style="overflow: auto; padding: 10px;" ><div style="overflow-x: visible;"> 
<code language="perl">
<pre> 

&lt;?xml <span class="category2">version</span>="<span class="quote">1.0</span>" encoding="<span class="quote">utf-8</span>"?&gt;
&lt;mx:WindowedApplication xmlns:mx="<span class="quote">http://www.adobe.com/2006/mxml</span>"  <span class="category2">width</span>="<span class="quote">400</span>" <span class="category2">height</span>="<span class="quote">300</span>" layout="<span class="quote">vertical</span>" horizontalAlign="<span class="quote">center</span>" verticalAlign="<span class="quote">middle</span>"
	nativeDragEnter="<span class="quote">handleDragEnter(event)</span>" 
	nativeDragDrop="<span class="quote">handleDropSwf(event)</span>"
	&gt;
	&lt;mx:Script&gt;
		&lt;![CDATA[
			<span class="category1">import</span> mx.controls.Alert;
			<span class="category1">import</span> com.hurlant.crypto.Crypto;
			<span class="category1">import</span> com.hurlant.crypto.symmetric.ICipher;
			<span class="category1">import</span> com.hurlant.crypto.prng.Random;
			
			<span class="category1">private</span> <span class="category1">function</span> handleDragEnter(event:NativeDragEvent):<span class="category1">void</span>
			{
 				NativeDragManager.acceptDragDrop(<span class="category1">this</span>);
 			}
			
			<span class="category1">private</span> <span class="category1">function</span> handleDropSwf(event:NativeDragEvent):<span class="category1">void</span>
			{
 				<span class="category1">var</span> filelist:<span class="category2">Array</span> = event.clipboard.<span class="category2">getData</span>("<span class="quote">air:file list</span>") as <span class="category2">Array</span>;
 				<span class="category1">for</span> each(<span class="category1">var</span> file:File <span class="category1">in</span> filelist)
 				{
  					<span class="linecomment">//do simple blowfish encryption for the swf file</span>
  					<span class="category1">var</span> fs:FileStream = <span class="category1">new</span> FileStream();
  					fs.open(file, FileMode.READ);
  					
  					<span class="category1">var</span> fileBytes:ByteArray = <span class="category1">new</span> ByteArray();
  					fs.readBytes(fileBytes);
  					fs.<span class="category2">close</span>();
  					
  					<span class="linecomment">//generate a random key</span>
  					<span class="category1">var</span> key:ByteArray = <span class="category1">new</span> ByteArray();
  					<span class="category1">var</span> <span class="category2">random</span>:Random = <span class="category1">new</span> Random();
  					<span class="category2">random</span>.nextBytes(key, 8);
  					
  					<span class="category1">var</span> aes:ICipher = Crypto.getCipher("<span class="quote">blowfish-ecb</span>", key, Crypto.getPad("<span class="quote">pkcs5</span>"));
  					aes.encrypt(fileBytes);
  					
  					<span class="linecomment">//rewrite the file with the encrypted blob</span>
  					fs.open(file, FileMode.WRITE);
  					fs.writeBytes(key);
  					fs.writeBytes(fileBytes);
  					fs.truncate();
  					fs.<span class="category2">close</span>();
  					fs = <span class="category1">null</span>;
  					
  					Alert.<span class="category2">show</span>("<span class="quote">Encryption Completed</span>", "<span class="quote">Results</span>");
  				}
 			}
		]]&gt;
	&lt;/mx:Script&gt;
	
	&lt;mx:Text <span class="category2">text</span>="<span class="quote">Drop SWF here to encrypt</span>"/&gt;
&lt;/mx:WindowedApplication&gt;</pre>
</code>
 
</div></div> 

<div class="ap_r" style="margin: 16px;"><a href="http://www.insideria.com/upload/2008/03/encryption_in_flex_application_1/article2_img4.png" class="highslide" onclick="return hs.expand(this)"><img src="http://www.insideria.com/upload/2008/03/encryption_in_flex_application_1/article2_img4.png" alt="article2_img4.png" title="Click to enlarge" width="148"/></a></div>
<div class="ap_r" style="margin: 16px;"><a href="http://www.insideria.com/upload/2008/03/encryption_in_flex_application_1/article2_img5.png" class="highslide" onclick="return hs.expand(this)"><img src="http://www.insideria.com/upload/2008/03/encryption_in_flex_application_1/article2_img5.png" alt="article2_img5.png" title="Click to enlarge" width="148"/></a></div>
<p>&nbsp;</p>
<p>&nbsp;</p>
<p>
Now that that&#8217;s done, launch the app and drop library.swf from CircleCalculatorInterface onto it.
</p>
<p>&nbsp;</p>
<p>&nbsp;</p>
<p>&nbsp;</p>
<p>
If you&#8217;re curious, you can drop the encrypted swf into a web browser, right-click and see that &#8220;movie not loaded&#133;&#8221; will appear.  Another test is to use a decompiler tool to ensure the encryption worked ok.
</p>
<p>
The final step in the process of creating an encrypted swc library is to create a Factory class in CircleCalculatorInterface that can interpret and understand our encrypted library.swf file.  You&#8217;ll also need to check the box in CircleCalculatorInterface properties for including the AIR libraries.  We do this so that our library can be used by either Flex or AIR when we release it to a client.
</p>

 <div class="acode" style="overflow: auto; padding: 10px;" ><div style="overflow-x: visible;"> 
<code language="perl">
<pre> 

package com.company
{
 	<span class="category1">import</span> com.hurlant.crypto.Crypto;
 	<span class="category1">import</span> com.hurlant.crypto.symmetric.ICipher;
 	
 	<span class="category1">import</span> flash.display.Loader;
 	<span class="category1">import</span> flash.events.Event;
 	<span class="category1">import</span> flash.events.EventDispatcher;
 	<span class="category1">import</span> flash.system.ApplicationDomain;
 	<span class="category1">import</span> flash.system.LoaderContext;
 	<span class="category1">import</span> flash.utils.ByteArray;
 	
 	<span class="category1">import</span> mx.core.ByteArrayAsset;
 	
 	<span class="category1">public</span> <span class="category1">class</span> CircleCalculatorFactory <span class="category1">extends</span> EventDispatcher 
 	{
  		<span class="linecomment">//this is the CircleCalculator library.swf file (encrypted with LibraryEncrypter of course)</span>
  		[Embed (source="<span class="quote">library.swf</span>", mimeType="<span class="quote">application/octet-stream</span>")]
  		<span class="category1">private</span> <span class="category1">var</span> encryptedSwf:Class;
  
  		<span class="category1">private</span> <span class="category1">var</span> _circleCalculator:ICircleCalculator=<span class="category1">null</span>;
  
  		<span class="category1">public</span> <span class="category1">function</span> CircleCalculatorFactory(completeHandler:<span class="category2">Function</span>)
  		{
   			<span class="category1">super</span>();
   			
   			<span class="category1">this</span>.addEventListener(Event.COMPLETE, completeHandler);
   			
   			<span class="linecomment">//load up the swf file that contains the CircleCalculator class</span>
   			<span class="category1">var</span> fileData:ByteArrayAsset = ByteArrayAsset(<span class="category1">new</span> encryptedSwf());
   
   			<span class="category1">var</span> key:ByteArray = <span class="category1">new</span> ByteArray();
   			fileData.readBytes(key, 0, 8);
   			<span class="category1">var</span> encryptedBytes:ByteArray = <span class="category1">new</span> ByteArray();
   			fileData.readBytes(encryptedBytes);
   			
   			<span class="linecomment">//decrypt library.swf</span>
   			<span class="category1">var</span> aes:ICipher = Crypto.getCipher("<span class="quote">blowfish-ecb</span>", key, Crypto.getPad("<span class="quote">pkcs5</span>"));
   			aes.decrypt(encryptedBytes);
   			
   			<span class="linecomment">//load the swf bytes into the current application domain</span>
   			<span class="category1">var</span> ldr:Loader = <span class="category1">new</span> Loader();
   			<span class="category1">var</span> ldrContext:LoaderContext = <span class="category1">new</span> LoaderContext(<span class="category1">false</span>, ApplicationDomain.currentDomain);
   			
   			<span class="linecomment">//do this for AIR support</span>
   			<span class="category1">if</span>(ldrContext.<span class="category2">hasOwnProperty</span>("<span class="quote">allowLoadBytesCodeExecution</span>"))
   				ldrContext.allowLoadBytesCodeExecution = <span class="category1">true</span>;
   				
   			ldr.contentLoaderInfo.addEventListener(Event.COMPLETE, loadSwfComplete);
   			ldr.loadBytes(encryptedBytes, ldrContext);
   		}
  		
  		<span class="category1">private</span> <span class="category1">function</span> loadSwfComplete(event:Event):<span class="category1">void</span>
  		{
   			<span class="category1">var</span> cc:Class = ApplicationDomain.currentDomain.getDefinition("<span class="quote">com.company.CircleCalculator</span>") as Class;
   			_circleCalculator = <span class="category1">new</span> cc();
   			dispatchEvent(<span class="category1">new</span> Event(Event.COMPLETE));
   		}
  		
  		<span class="blockcomment">/**
  		 * @return an object implementing the ICircleCalculator interface
  		 */</span>
  		<span class="category1">public</span> <span class="category1">function</span> getInstance():ICircleCalculator
  		{
   			<span class="category1">return</span> _circleCalculator;
   		}
  	}
}</pre>
</code>
 
</div></div> 

<p>
Lastly, let&#8217;s create an example Flex application that loads and uses our CircleCalculatorInterface library project.
</p>
 <div class="acode" style="overflow: auto; padding: 10px;" ><div style="overflow-x: visible;"> 
<code language="perl">
<pre> 

&lt;?xml <span class="category2">version</span>="<span class="quote">1.0</span>" encoding="<span class="quote">utf-8</span>"?&gt;
&lt;mx:<span class="category2">Application</span> xmlns:mx="<span class="quote">http://www.adobe.com/2006/mxml</span>" xmlns:degrafa="<span class="quote">com.degrafa.*</span>" xmlns:paint="<span class="quote">com.degrafa.paint.*</span>" xmlns:geometry="<span class="quote">com.degrafa.geometry.*</span>"
	backgroundGradientColors="<span class="quote">[#666666, #222222]</span>"
	layout="<span class="quote">absolute</span>" viewSourceURL="<span class="quote">srcview/index.html</span>"&gt;
	&lt;mx:Script&gt;
		&lt;![CDATA[
			<span class="category1">import</span> com.company.ICircleCalculator;
			<span class="category1">import</span> com.company.CircleCalculatorFactory;
			
			<span class="category1">private</span> <span class="category1">var</span> circleCalcFactory:CircleCalculatorFactory = <span class="category1">new</span> CircleCalculatorFactory(initComplete);
			<span class="category1">private</span> <span class="category1">var</span> circleCalculator:ICircleCalculator = <span class="category1">null</span>;
						
			[Bindable]
			<span class="category1">private</span> <span class="category1">var</span> circumference:<span class="category2">Number</span>=0;
			
			[Bindable]
			<span class="category1">private</span> <span class="category1">var</span> area:<span class="category2">Number</span>=0;
			
			<span class="category1">private</span> <span class="category1">function</span> initComplete(event:Event):<span class="category1">void</span>
			{
 				circleCalculator = circleCalcFactory.getInstance();
 				calculateCircle();
 			}
			
			<span class="category1">private</span> <span class="category1">function</span> calculateCircle():<span class="category1">void</span>
			{
 				circumference = circleCalculator.calcCircumference(radiusSlider.value);
 				area = circleCalculator.calcArea(radiusSlider.value);
 			}
		]]&gt;
	&lt;/mx:Script&gt;
	&lt;mx:VBox <span class="category2">x</span>="<span class="quote">20</span>" <span class="category2">y</span>="<span class="quote">20</span>"&gt;
		&lt;mx:Label <span class="category2">text</span>="<span class="quote">Radius:</span>"/&gt;
		&lt;mx:HSlider id="<span class="quote">radiusSlider</span>" value="<span class="quote">100</span>" minimum="<span class="quote">10</span>" maximum="<span class="quote">400</span>" <span class="category2">width</span>="<span class="quote">200</span>" change="<span class="quote">calculateCircle()</span>" liveDragging="<span class="quote">true</span>"/&gt;
		&lt;mx:Spacer <span class="category2">height</span>="<span class="quote">20</span>"/&gt;
		&lt;mx:Text <span class="category2">text</span>="<span class="quote">Circumference: {circumference}</span>"/&gt;
		&lt;mx:Text <span class="category2">text</span>="<span class="quote">Area: {area}</span>"/&gt;
	&lt;/mx:VBox&gt;
	
	&lt;degrafa:Surface horizontalCenter="<span class="quote">0</span>" verticalCenter="<span class="quote">0</span>"&gt;
        &lt;degrafa:fills&gt;
            &lt;paint:SolidFill    id="<span class="quote">blue</span>"
                                <span class="category2">color</span>="<span class="quote">#9999ff</span>"/&gt;
        &lt;/degrafa:fills&gt;
        
        &lt;degrafa:strokes&gt;
            &lt;paint:SolidStroke  id="<span class="quote">white</span>"
                                <span class="category2">color</span>="<span class="quote">#FFFFFF</span>"
                                alpha="<span class="quote">1</span>"
                                weight="<span class="quote">2</span>"/&gt;
        &lt;/degrafa:strokes&gt;
        
        &lt;degrafa:GeometryGroup&gt;
        
			&lt;geometry:Circle    fill="<span class="quote">{blue}</span>"
			                    stroke="<span class="quote">{white}</span>"
			                    radius="<span class="quote">{radiusSlider.value}</span>"/&gt;
            
        &lt;/degrafa:GeometryGroup&gt;
	&lt;/degrafa:Surface&gt;
&lt;/mx:<span class="category2">Application</span>&gt;</pre>
</code>
 
</div></div> 


<p>
<a href="http://flexjunk.com/examples/FlexEncryptionExample2/FlexEncryptionExample2.html">CircleCalculatorExample</a>
</p>]]>
      
    </content>
  </entry>

  <entry>
    <id>tag:www.insideria.com,2008://34.23249-comment:2019357</id>
    <thr:in-reply-to ref="tag:www.insideria.com,2008://34.23249" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html"/>
    <link rel="alternate" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html#comment-2019357" />
    <title>Comment from Bob on 2008-07-28</title>
    <author>
        <name>Bob</name>
        <uri></uri>
    </author>
    <content type="html" xml:lang="en" xml:base="">
        <![CDATA[<p>Hi,</p>

<p>Cool article!<br />
Where could we find the AIR LibraryEncrypter application?</p>

<p>Thanks</p>]]>
    </content>
    <published>2008-07-28T18:24:52Z</published>
  </entry>

  <entry>
    <id>tag:www.insideria.com,2008://34.23249-comment:2019362</id>
    <thr:in-reply-to ref="tag:www.insideria.com,2008://34.23249" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html"/>
    <link rel="alternate" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html#comment-2019362" />
    <title>Comment from Andrew Westberg on 2008-07-28</title>
    <author>
        <name>Andrew Westberg</name>
        <uri>http://www.flexjunk.com</uri>
    </author>
    <content type="html" xml:lang="en" xml:base="http://www.flexjunk.com">
        <![CDATA[<p>The LibraryEncrypter application source code is available in the article.</p>]]>
    </content>
    <published>2008-07-28T19:22:32Z</published>
  </entry>

  <entry>
    <id>tag:www.insideria.com,2008://34.23249-comment:2042097</id>
    <thr:in-reply-to ref="tag:www.insideria.com,2008://34.23249" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html"/>
    <link rel="alternate" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html#comment-2042097" />
    <title>Comment from kev on 2008-08-31</title>
    <author>
        <name>kev</name>
        <uri></uri>
    </author>
    <content type="html" xml:lang="en" xml:base="">
        <![CDATA[<p>Hi Andrew,</p>

<p>This series of articles has been an excellent insight into some methods of protecting swf assets.  I agree the Nitro solution sounds like the easiest and most complete to implement.  However, the licensing agreements do not suit all applications.</p>

<p>Take for example a project I am soon to be commencing - it will not be mass-marketed or widely deployed and I am less concerned about people decompiling the swfs to see how I 'make things work'.  But more so concerned about them seeing how I communicate to backend servers.</p>

<p>Using the information you've provided, I can see how it would be easy enough to encrypt the most sensitive parts of the app and store the key on a remote server.  But access to the key, in the application init is where I am a little confused.</p>

<p>Using a username & password is a given but these can easily be shared.  Once they have been, decompiling the app init swf and authenticating with these credentials to get the key via a php page or remote object would be relatively easy for those that are interested in decompiling anyway.</p>

<p>The app init could be encrypted also but as AIR lacks the ability to deploy an encrypted local store with the application, I am at a loss as to how I could keep the call to get the key a secret.</p>

<p>Does this make sense?</p>

<p>Do you have any insights you'd like to share?</p>

<p><br />
Thanks for any help!</p>]]>
    </content>
    <published>2008-08-31T07:23:45Z</published>
  </entry>

  <entry>
    <id>tag:www.insideria.com,2008://34.23249-comment:2042099</id>
    <thr:in-reply-to ref="tag:www.insideria.com,2008://34.23249" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html"/>
    <link rel="alternate" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html#comment-2042099" />
    <title>Comment from Andrew Westberg on 2008-08-31</title>
    <author>
        <name>Andrew Westberg</name>
        <uri>http://www.simplifiedlogic.com/nitrolm/blog</uri>
    </author>
    <content type="html" xml:lang="en" xml:base="http://www.simplifiedlogic.com/nitrolm/blog">
        <![CDATA[<p>@kev,<br />
Using the Nitro-LM solution, talking to the server "on-your-own" without using their encrypted library over an encrypted channel to retrieve keys isn't a trivial task as you suggest.  The decryption keys coming down from the server are themselves buried under ~5 layers of encryption that can only be interpreted by Simplified Logic's encrypted SWC.</p>

<p>Honestly, with any interpreted language like Java or the Flash player, it's not possible to have something be 100% secure.  Nitro-LM was designed to be about 99.5% secure, and so complex that the other 0.5% of people would become quickly frustrated.  Along with each layer of its encrypted communication, there are also a number of proprietary obfuscation techniques employed.<br />
</p>]]>
    </content>
    <published>2008-08-31T12:24:04Z</published>
  </entry>

  <entry>
    <id>tag:www.insideria.com,2008://34.23249-comment:2042103</id>
    <thr:in-reply-to ref="tag:www.insideria.com,2008://34.23249" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html"/>
    <link rel="alternate" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html#comment-2042103" />
    <title>Comment from kev on 2008-08-31</title>
    <author>
        <name>kev</name>
        <uri></uri>
    </author>
    <content type="html" xml:lang="en" xml:base="">
        <![CDATA[<p>Hi Andrew, apologies if I mislead you - I didn't mean to suggest that I aim to write something as robust as the Nitro-LM solution.  But merely make it more difficult for the contents of a remote database to be accessed.  I was hoping there might be another more secure way of accessing remote data or hiding the calls in the swf that I'm failing to think of at present.  Sometimes I get sidetracked and 'can't see the forest for the trees' as they say...</p>

<p>I guess another way might be to employ multiple levels of encryption to make it more 'annoying' to decrypt.</p>

<p>Cheers</p>]]>
    </content>
    <published>2008-08-31T15:08:40Z</published>
  </entry>

  <entry>
    <id>tag:www.insideria.com,2008://34.23249-comment:2042117</id>
    <thr:in-reply-to ref="tag:www.insideria.com,2008://34.23249" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html"/>
    <link rel="alternate" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html#comment-2042117" />
    <title>Comment from Andrew Westberg on 2008-08-31</title>
    <author>
        <name>Andrew Westberg</name>
        <uri>http://www.simplifiedlogic.com/nitrolm/blog</uri>
    </author>
    <content type="html" xml:lang="en" xml:base="http://www.simplifiedlogic.com/nitrolm/blog">
        <![CDATA[<p>@kev,<br />
In Nitro-LM, we protect server calls by requiring that they pass an app-id value along with the request.  An app can retrieve this from the LM server after a valid authentication and pass it along with any call to your server-side code over https.  On the server-side, you can add calls to validate the app-id.</p>

<p>In a sense, the app-id is a token you can pass to the server code so that it knows the request is coming from your own application that has been authenticated using Nitro-LM.</p>]]>
    </content>
    <published>2008-09-01T00:28:09Z</published>
  </entry>

  <entry>
    <id>tag:www.insideria.com,2008://34.23249-comment:2042119</id>
    <thr:in-reply-to ref="tag:www.insideria.com,2008://34.23249" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html"/>
    <link rel="alternate" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html#comment-2042119" />
    <title>Comment from kev on 2008-08-31</title>
    <author>
        <name>kev</name>
        <uri></uri>
    </author>
    <content type="html" xml:lang="en" xml:base="">
        <![CDATA[<p>Thaks Andrew - some great food for thought there.  I'll be sure to offer the Nitro-LM solution as the safest option.  </p>

<p>Cheers</p>]]>
    </content>
    <published>2008-09-01T01:19:01Z</published>
  </entry>

  <entry>
    <id>tag:www.insideria.com,2008://34.23249-comment:2043505</id>
    <thr:in-reply-to ref="tag:www.insideria.com,2008://34.23249" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html"/>
    <link rel="alternate" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html#comment-2043505" />
    <title>Comment from Tim on 2008-09-30</title>
    <author>
        <name>Tim</name>
        <uri>http://avoka.com</uri>
    </author>
    <content type="html" xml:lang="en" xml:base="http://avoka.com">
        <![CDATA[<p>This is very interesting. What stops someone decompiling the decrypter to obtain the decryption algorithm and key - even if obfuscation or a service call is used - and using that to decrypt and then decompile the embedded asset?</p>]]>
    </content>
    <published>2008-09-30T23:27:40Z</published>
  </entry>

  <entry>
    <id>tag:www.insideria.com,2008://34.23249-comment:2043539</id>
    <thr:in-reply-to ref="tag:www.insideria.com,2008://34.23249" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html"/>
    <link rel="alternate" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html#comment-2043539" />
    <title>Comment from Andrew Westberg on 2008-10-01</title>
    <author>
        <name>Andrew Westberg</name>
        <uri>http://www.simplifiedlogic.com/nitrolm/blog</uri>
    </author>
    <content type="html" xml:lang="en" xml:base="http://www.simplifiedlogic.com/nitrolm/blog">
        <![CDATA[<p>@Tim,</p>

<p>Good question.</p>

<p>If the individual trying to crack your application is on the inside (having successfully authenticated before using the service call to retrieve a key), there isn't much you can do if the person is sufficiently skilled enough.  This is mainly a limitation of the Flash, .NET, and Java platforms in that the bytecode they produce are inherently easy to reverse-engineer.  The solution I've presented is designed to keep out 90-95+% of people.  A really skilled reverse-engineer hellbent on getting your code with lots of free time is probably going to be successful in their goals.</p>]]>
    </content>
    <published>2008-10-01T18:41:00Z</published>
  </entry>

  <entry>
    <id>tag:www.insideria.com,2008://34.23249-comment:2043678</id>
    <thr:in-reply-to ref="tag:www.insideria.com,2008://34.23249" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html"/>
    <link rel="alternate" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html#comment-2043678" />
    <title>Comment from Don on 2008-10-04</title>
    <author>
        <name>Don</name>
        <uri></uri>
    </author>
    <content type="html" xml:lang="en" xml:base="">
        <![CDATA[<p>tim has a good point, your code is still in the swf and can be extracted easily. Especially since your are using an automated tool, takes a few minutes to enhance any reverseengineering too to detect this and extract the real code.</p>

<p>If you want to be sure no one steals your code, you still have to use a tool like irrfuscator for flex or flashncrypt for flash.</p>]]>
    </content>
    <published>2008-10-04T07:47:00Z</published>
  </entry>

  <entry>
    <id>tag:www.insideria.com,2008://34.23249-comment:2043699</id>
    <thr:in-reply-to ref="tag:www.insideria.com,2008://34.23249" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html"/>
    <link rel="alternate" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html#comment-2043699" />
    <title>Comment from Andrew Westberg on 2008-10-04</title>
    <author>
        <name>Andrew Westberg</name>
        <uri>http://www.simplifiedlogic.com/nitrolm/blog</uri>
    </author>
    <content type="html" xml:lang="en" xml:base="http://www.simplifiedlogic.com/nitrolm/blog">
        <![CDATA[<p>@Don,</p>

<p>Thanks for your comments.</p>

<p>While obfuscation can be good for small projects, it quickly can become a babysitting job for a large project.  It requires you double-test your code since the code you write isn't the code you run.  You have to ensure that the obfuscator hasn't introduced an issue into your code.</p>

<p>In the above example, you're correct that this isn't terribly hard to reverse engineer for a skilled programmer.  What I was referring to in the comments was a different method of storing the key server-side (as is used in the Nitro-LM tools).  It's delivered over an encrypted channel and decrypts Flex/AIR modules in memory.  There's no opportunity for a hacker to capture the key so your code stays secure.</p>

<p>I really should write a new article on Module encryption since the three I've done here so far are becoming somewhat dated.</p>]]>
    </content>
    <published>2008-10-04T23:12:46Z</published>
  </entry>

  <entry>
    <id>tag:www.insideria.com,2008://34.23249-comment:2054718</id>
    <thr:in-reply-to ref="tag:www.insideria.com,2008://34.23249" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html"/>
    <link rel="alternate" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html#comment-2054718" />
    <title>Comment from Oscar on 2009-03-08</title>
    <author>
        <name>Oscar</name>
        <uri></uri>
    </author>
    <content type="html" xml:lang="en" xml:base="">
        <![CDATA[<p>Dear Andrew,<br />
I'm thinking of using the encryption as you explained it in the example above. I would like to make an "envelope swf" that only reads, decrypts and runs my large main.swf (encrypted) application file. <br />
Is that possible/smart/stupid? <br />
Can you give a hint on how I can best structure the envelope swf?<br />
Thanks.<br />
Oscar</p>]]>
    </content>
    <published>2009-03-08T19:54:24Z</published>
  </entry>

  <entry>
    <id>tag:www.insideria.com,2008://34.23249-comment:2054740</id>
    <thr:in-reply-to ref="tag:www.insideria.com,2008://34.23249" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html"/>
    <link rel="alternate" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html#comment-2054740" />
    <title>Comment from Andrew Westberg on 2009-03-09</title>
    <author>
        <name>Andrew Westberg</name>
        <uri>http://www.flexjunk.com</uri>
    </author>
    <content type="html" xml:lang="en" xml:base="http://www.flexjunk.com">
        <![CDATA[<p>@Oscar,</p>

<p>It is possible to create a wrapper swf that simply decrypts and runs a main swf file.  It's better than nothing, but it does have some drawbacks.  The key must be stored server-side and protected by other security measures, otherwise, your swf is vulnerable to decompilation.  You'll also likely suffer a bit of a performance hit unless your application is very small.</p>

<p>In Nitro-LM, we recommend to create a modular application (mx:Module), encrypt them, and use our EncryptedModuleLoader.  Asymmetric decryption keys are stored on the server behind the Nitro-LM licensing and authentication system.</p>

<p>This article is becoming quite dated.  Take a look at the three video posts about encrypting modules on the Nitro-LM blog.</p>

<p><a href="http://www.simplifiedlogic.com/nitrolm/blog">http://www.simplifiedlogic.com/nitrolm/blog</a></p>

<p>We're working on a new administration tool.  I hope to get some new content and how-tos posted here once that is closer to completed.</p>]]>
    </content>
    <published>2009-03-09T11:24:22Z</published>
  </entry>

  <entry>
    <id>tag:www.insideria.com,2008://34.23249-comment:2055266</id>
    <thr:in-reply-to ref="tag:www.insideria.com,2008://34.23249" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html"/>
    <link rel="alternate" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html#comment-2055266" />
    <title>Comment from Oscar on 2009-03-16</title>
    <author>
        <name>Oscar</name>
        <uri></uri>
    </author>
    <content type="html" xml:lang="en" xml:base="">
        <![CDATA[<p>@Andrew,</p>

<p>Thanks for your reply.</p>

<p>I've made the wrapper (using the code from <a href="http://blogs.soph-ware.com/?p=14),">http://blogs.soph-ware.com/?p=14),</a> and it works (sort of) but only to conclude that it doesn't help me much. <br />
In my case, I distribute the "wrapper swf" and "encrypted swf" to be installed and run locally on top of a c++ application. When decompiling the wrapper, it simply loads and decrypts the encrypted swf et voila, everything is in the open again ... Could have thought of that before ...<br />
It was very educational for me, but I'll have to do the decryption from the c++ application.</p>

<p>(Next to that I had problems to get a 100% display of the original swf. Fonts and layout were different at certain points and there was some padding I couldn't get rid of.)<br />
</p>]]>
    </content>
    <published>2009-03-16T16:11:29Z</published>
  </entry>

  <entry>
    <id>tag:www.insideria.com,2008://34.23249-comment:2055278</id>
    <thr:in-reply-to ref="tag:www.insideria.com,2008://34.23249" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html"/>
    <link rel="alternate" type="text/html" href="http://www.insideria.com/2008/04/encryption-in-flex-application-1.html#comment-2055278" />
    <title>Comment from Andrew Westberg on 2009-03-16</title>
    <author>
        <name>Andrew Westberg</name>
        <uri>http://www.flexjunk.com</uri>
    </author>
    <content type="html" xml:lang="en" xml:base="http://www.flexjunk.com">
        <![CDATA[<p>@Oscar,</p>

<p>I'm not associated with the soph-ware website.  If you want a true C++/Flex solution, I'd check out Nitro-LM (disclaimer, I consult for them).  They have either a C++ dll, or a Flex SWC you can hook into to retrieve keys from the server-side to handle encryption/decryption.  It's a public/private key system, and the keys are delivered over a secure connection after the user authenticates, so nothing is ever in the clear.</p>]]>
    </content>
    <published>2009-03-16T17:15:17Z</published>
  </entry>

</feed
