If I have a private key with which I sign byte code, and a public key with which I can decipher the signed code to verify its authenticity, can I protect that byte code from being reverse engineered and modified as follows:
- Built an abstract machine to interpret the byte code in plain text.
- Apply code generation techniques to this to be able to generate a unique machine for each end user, paired with a public key for that user, in such a way that the byte code machine verifies the byte code as each instruction is executed. That is, the verifier is woven into the machine.
- The bytecode interpreter itself is ofuscated in a non-reversible manner, using the petri-nets technique.
- Sign the bytecode for each user by encrypting it with the a secret key, unique to the user but not accessible to them.
Now the bytecode can easily be decrypted by each user with their key, but they do not posses a copy of the plain text machine to run it.
If users modify the code, they cannot sign it to run on the machine that they do have, since they do not possess the secret key needed to do this.
Perhaps this technique is already widely known and in use?
Please note, this question is not about whether this makes reverse engineering absolutely impossible, as I understand that no technique is ever going to be perfect and there are good reasons for that. I want to know whether this would be a practical deterrent and viable technique, have such techniques already been explored/discredited or is this considered a reasonably good one, relative to other protection techniques.
13
No. There is nothing in your scheme that prevents a user from reverse engineering the bytecode interpreter and either (1) removing the verification steps or (2) changing the public key which must be encoded within it somehow to one they know the equivalent private key of.
3