Support encrypting bytecode to obfuscate source

[johnthagen]

To raise the bar for accessing bundled .pyc files within a PyOxidizer executable, would you consider adding a feature to encrypt the embedded .pyc files?

This makes it more difficult to recover the original source code (though, of course it's possible given enough work because the key is stored in the binary).

Pyinstaller supports this using the --key option.

MATLAB also does something similar to allow better protection of source code: https://www.mathworks.com/products/compiler.html#encrypted-royalty-free

This was originally discussed in #38.

[johnthagen]

Some crate options:

• https://github.com/RustCrypto/block-ciphers#supported-algorithms
• https://briansmith.org/rustdoc/ring/

[indygreg]

I'm not opposed to adding this feature.

However, encrypted bytecode with a distributed key to decrypt is essentially "security theater" since it merely raises the bar and doesn't really protect anything from a determined attacker. However, I'm a pragmatist and realize some customers insist on this feature. So it makes sense to add someday.

Thank you for the link to PyInstaller's equivalent feature!

If someone could do the heavy lifting and post a technical explanation for how the feature works and/or link to source code, that would save time on implementation...

[johnthagen]

@indygreg Completely agree with all of your thoughts.

Also, it's worth noting in their default configurations, PyOxidizer is already more obfuscated than PyInstaller. PyInstaller must extract the .pyc files to a temporary directory while running, while PyOxidizer does not. This makes it easier for a low-bar attacker to copy the .pyc files from PyInstaller without having to dissect the binary.

PyInstaller Implementation

• PyInstaller takes in a --key option from the CLI and derives an AES-128 key from that.

  • https://github.com/pyinstaller/pyinstaller/blob/253feb7e16cd3a6a6d3ea2fb80c3491d30671e39/PyInstaller/loader/pyimod02_archive.py#L246

• Here is the PR that recently overhauled this feature: Replace PyCrypto with tinyaes for encryption support pyinstaller/pyinstaller#4652

• PyInstaller uses tinyaes to perform it's encryption

  • https://github.com/pyinstaller/pyinstaller/blob/253feb7e16cd3a6a6d3ea2fb80c3491d30671e39/PyInstaller/loader/pyimod02_archive.py#L265

[johnthagen]

FWIW, Pyinstaller is removing this feature for reasons stated below.

• Remove the --key/cipher bytecode encryption. pyinstaller/pyinstaller#6999
• Deprecate bytecode encryption (for #6999). pyinstaller/pyinstaller#7294

Since I'm the one who originally opened this request, I'm going to simply close it as I don't think the benefits are high enough to justify the complexity.