EddTally
Elixir Version of Javas Encrypted Class Files? -> Securing Elixir Code
I have a Java class which is stored as an encrypted class for important security reasons then only decrypted at application startup, this is completed by various Java tools, I would like the same to happen to my Elixir Module.
Is there a similar/recommended thing in Elixir/Erlang?
Most Liked
hauleth
If the module is unencrypted in memory, then they can dump all of that. If you encrypted the module, then you also have key for that encryption stored anywhere in the memory or in a file that is readable by current application.
In short, it doesn’t really make sense to me to encrypt the BEAM files.
harmon25
You must secure the keys. Not the methods.
A motivated attacker can likely guess or infer the method based on structure of the encrypted blob.
hauleth
Just use method properly, then even if there will be a breach, as long as the key do not leak, you will be safe. There is little to no point of keeping encryption method secret. It can help with slowing down attack, but itself it does nothing. As long as your protocol do not have flaws and keys are secure then forcing yourself with hiding encryption method is pointless. See at the TLS where encryption method is actually public.







