I asked this question over on the reverse engineering Stack Exchange but was told to post it here instead, even though I felt the question didn't really fit here.

To recap, I'm writing some (open source) software that talks to some hardware. The communication is encrypted, but I managed to find the encryption key in their app. I know I can't distribute the key, but can I give people instructions on how to find the key?

I was planning on making it step-by-step (e.g. "go to app-downloader.example.com, type in 'com.example.app', download the file, upload it to app-decompiler.example.xyz and look in path/to/private.key"), but also wondered itf it was better to scale it back (e.g. "download the app, decompile it, look in there for the password").

I plan to chat to a lawyer when it comes closer to release time, but for now, I'd like to know if I should put the effort in documenting the process or not.

EDIT: To further clarify, my app's purpose is to achieve interoperability, or in this case, operability. The app which houses the private key is literally unusable -- I've made 30+ attempts and tried three different phones and their app won't connect to their hardware. Many others are experiencing the same (1.6/5 stars on Google Play, 16 1-star reviews out of 24 total). Early signs tells me that my code could connect, providing I can encrypt and decrypt the information necessary. Support is non-existent (they stopped replying to comments mid last year, and no updates in that long either).

U.S. Code § 1201 - Circumvention of copyright protection systems tells me that:

Notwithstanding the provisions of subsection (a)(1)(A), a person who has lawfully obtained the right to use a copy of a computer program may circumvent a technological measure that effectively controls access to a particular portion of that program for the sole purpose of identifying and analyzing those elements of the program that are necessary to achieve interoperability of an independently created computer program with other programs, and that have not previously been readily available to the person engaging in the circumvention

So as far as I can tell, I'm within my rights to create the code, as my goal is to achieve interoperability, by letting users control this hardware (a Chinese version of a Belkin WeMo WiFi switch) with their home automation system.

So my goal isn't to "stand outside a bank at midnight and offer to give away the access code to the front doors", but rather to stand out the front of a bank during opening hours and show them how to operate the door when they can't get in, and the bank refuses to fix the door.

EDIT 2: Since then, I've discovered that I can make this key extraction process even more generic. The app can be freely downloaded from their website. If I download it, read a single file in there and tell my computer to find anything that is 16 alphanumeric characters long in that file (the encryption type they use states that the password MUST be 16 characters long), then it can find it.

So now that's what I'm attempting to focus on, because I don't need to distribute anything, I just need to write code to download the file from their public website, pull out all the 16-character long strings from the file (there are a few) and try each key until the correct one is found.

  • Interesting question. One could argue that, once you distribute instructions, you have no way to ensure that other people will be using the private key just to achieve interoperability, and thus, that you may be helping people to illegally circumvent those protections. However, I'm not sure and I'm not a lawyer, so I'm not going to post this as an answer. – A. Darwin May 21 '16 at 8:34
  • The reverse engineering subsection you excerpted has FOUR paragraphs, of which you cited only the first.The other paragraphs outline the non-infringing criteria of such reverse engineering and you must follow ALL of them if you want to "make them available to others". – Upnorth Aug 21 '17 at 3:30
  • @Upnorth: I'll read over those again, as you make a good point about me not citing all four. Also see my second edit, as my tactic has now changed. Rather than looking to distribute part of the key, I've now got a script that downloads the file from their website, pulls out a single file, gets all 16-character long strings and tries those until the right one is found. Gone from billions of possibilities to 100 or so without distributing even a single part of the key. – Grayda Aug 21 '17 at 23:17
  • 1
    @grayda If challenged, someone doing as you suggest would still have the burden of proving that "such means are necessary to achieve such interoperability" and that supplying such info does not exceed the extent necessary to avoid being a copyright infringement. § 1201 (f)(2). – Upnorth Aug 23 '17 at 19:36
  • Have you eventually find the answer? What is written in the original license terms that you signed purchasing or installing the original software? Also a side comment, it is an interesting question from security standpoint. There was also a related discussion, actually from the opposite perspective, here: security.stackexchange.com/questions/72717/… – Refineo 15 hours ago

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.