I asked this question over on the reverse engineering Stack Exchange but was told to post it here instead, even though I felt the question didn't really fit here.
To recap, I'm writing some (open source) software that talks to some hardware. The communication is encrypted, but I managed to find the encryption key in their app. I know I can't distribute the key, but can I give people instructions on how to find the key?
I was planning on making it step-by-step (e.g. "go to app-downloader.example.com, type in 'com.example.app', download the file, upload it to app-decompiler.example.xyz and look in path/to/private.key"), but also wondered itf it was better to scale it back (e.g. "download the app, decompile it, look in there for the password").
I plan to chat to a lawyer when it comes closer to release time, but for now, I'd like to know if I should put the effort in documenting the process or not.
EDIT: To further clarify, my app's purpose is to achieve interoperability, or in this case, operability. The app which houses the private key is literally unusable -- I've made 30+ attempts and tried three different phones and their app won't connect to their hardware. Many others are experiencing the same (1.6/5 stars on Google Play, 16 1-star reviews out of 24 total). Early signs tells me that my code could connect, providing I can encrypt and decrypt the information necessary. Support is non-existent (they stopped replying to comments mid last year, and no updates in that long either).
U.S. Code § 1201 - Circumvention of copyright protection systems tells me that:
Notwithstanding the provisions of subsection (a)(1)(A), a person who has lawfully obtained the right to use a copy of a computer program may circumvent a technological measure that effectively controls access to a particular portion of that program for the sole purpose of identifying and analyzing those elements of the program that are necessary to achieve interoperability of an independently created computer program with other programs, and that have not previously been readily available to the person engaging in the circumvention
So as far as I can tell, I'm within my rights to create the code, as my goal is to achieve interoperability, by letting users control this hardware (a Chinese version of a Belkin WeMo WiFi switch) with their home automation system.
So my goal isn't to "stand outside a bank at midnight and offer to give away the access code to the front doors", but rather to stand out the front of a bank during opening hours and show them how to operate the door when they can't get in, and the bank refuses to fix the door.
EDIT 2: Since then, I've discovered that I can make this key extraction process even more generic. The app can be freely downloaded from their website. If I download it, read a single file in there and tell my computer to find anything that is 16 alphanumeric characters long in that file (the encryption type they use states that the password MUST be 16 characters long), then it can find it.
So now that's what I'm attempting to focus on, because I don't need to distribute anything, I just need to write code to download the file from their public website, pull out all the 16-character long strings from the file (there are a few) and try each key until the correct one is found.