Encrypting and/or protecting assets within your app

[renato.bugge]

@thodah11

Some global method of encryption should be relativly easy to add to Corona and that would really help as many developers don’t want they game assets spread all around. Android is no safer than IOS. Count on rooted phones.

Would be really helpfull and usefull if this was provided by the SDK.

You can check out the AESlua which is quite fast with the new bitOp pluging:

http://forums.coronalabs.com/topic/28934-corona-resource-centre-tutorials-templates-and-more/?view=getnewpost

AES is probably the most secure encryption for lua at the moment.

[lessmsios]

Perhaps adding PASSWORD support to the recent zip/unzip plugin would be helpful.

[toby2]

Simply:

1. Use a UUID for the device.

2. Use HMAC to create a hash using some secure value, the UUID and a secret key.

3. Store the HMAC alongside the cleartext, and require agreement before unlocking whatever your data represents, an IAP entitlement, a high score, whatever. If the hashes don’t match, you’ve detected tampering and are free to zero out that entitlement or privileged data.

[lessmsios]

Perhaps adding PASSWORD support to the recent zip/unzip plugin would be helpful.

[toby2]

Simply:

1. Use a UUID for the device.

2. Use HMAC to create a hash using some secure value, the UUID and a secret key.

3. Store the HMAC alongside the cleartext, and require agreement before unlocking whatever your data represents, an IAP entitlement, a high score, whatever. If the hashes don’t match, you’ve detected tampering and are free to zero out that entitlement or privileged data.