bugGNU Octave - Bugs: bug #56633, Know how protection: Running...

 
 

bug #56633: Know how protection: Running encrypted program files

Submitter:  Georg Wiora <gwiora>
Submitted:  Mon 15 Jul 2019 02:15:52 PM UTC
   
 
Category:  Interpreter Severity:  1 - Wish
Priority:  1 - Later Item Group:  Feature Request
Status:  Wont Fix Assigned to:  None
Originator Name:  gwiora Open/Closed:  * Closed
Release:  * other Operating System:  * Any
Fixed Release:  None Planned Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 16 Jul 2019 07:46:45 AM UTC, comment #4: 

Thank you very much for your valuable comments! I will try to answer all questions from bottom to top starting with Kai Torben:

Kai Torben's comment #1:

> 1. Octave is free/libre and open source software.  This is the nature of the GPL to not obfuscate:
>
> https://wiki.octave.org/wiki/index.php?title=FAQ&oldid=12052#How_do_I_run_a_Matlab_P-file_in_Octave.3F

My concern is not the obsfuscation but what Mike pointed to: Protection of privacy is important to our work.

comment #1:

> 2. If you write software depending on Octave, please make sure, that you do not violate the GPL license terms:


Thank you for the hint! I just checked it again and found we are perfectly aligned with octave license conditions.
 
comment #1:

> 3. If you earn money using Octave, please consider contributing back.  I've seen you already submitted patches to Octave.  Development power is needed, otherwise jwe would not mind a small tip for all his great effort you benefit from, and your customers as well. https://www.gnu.org/software/octave/donate.html


This is a must in my eyes: Octave saves us money and we earn some money with our code written in octave, therefore we are donating back in form of (yet small) code contributions and my work power as much as I can do to improve octave. I also sent the donation link last year to my boss and it was very easy to convince him of the good purpose to donate money to octave. I think I can convince him again this year :)

Mike's comment #2:

> However, I do think this is entirely outside of the scope of Octave. Privacy software is really hard to get right, and Octave is already hard enough. I do not think it is worth the risk to Octave and its maintainers to try to take something like this on.
>
> I would recommend using the GnuPG program to encrypt and decrypt files as needed, and maybe something like an encrypted loop back device to host the files while they are temporarily decrypted to be read by Octave.

I agree that it is not a good idea to overload octave with specific implementations of security code. Even when using the common libraries for this, small portions of code inside octave can break the whole chain.

My recommendation is to provide a (plugin?) interface that allows octave to read source code (and maybe even data files) from a stream or file provider. This is very similar to Mike's suggestion using some kind of loop back decryption device. Maybe it is already a good solution to read source code from a (relatively) secure anonymous pipeline at least under unix. I don't know if this would work under windows too.

Michael's comment #3:

> User code can be written in such a way that it is made clear that it is only for use by those who have been granted permission by the owners. Managing that and taking action is case of violations is up to the software owners.

You are right that users have to complement security code with legal measures. But the outside world is not every where respecting these rules. Best protection of know how stays privacy.

Conclusion

What do you think about my suggestions? Would it be possible adding pipeline reading/interpretation of source code to octave?

Georg Wiora <gwiora>
Mon 15 Jul 2019 07:34:28 PM UTC, comment #3: 

Mike's comments below seem to me appropriate. This should
not be an Octave responsibility. Users can organize methods
to protect their software in various ways. And, no
protection is perfectly secure. User code can be written in
such a way that it is made clear that it is only for use
by those who have been granted permission by the owners.
Managing that and taking action is case of violations is
up to the software owners.

Michael Godfrey <godfrey>
Group Member
Mon 15 Jul 2019 04:39:00 PM UTC, comment #2: 

As a second different opinion from Kai, I do not think this is a request for obfuscation, but a request for a genuine privacy extension that would protect user's data and programs. This is not against the ideals of the free software community.

However, I do think this is entirely outside of the scope of Octave. Privacy software is really hard to get right, and Octave is already hard enough. I do not think it is worth the risk to Octave and its maintainers to try to take something like this on.

I would recommend using the GnuPG program to encrypt and decrypt files as needed, and maybe something like an encrypted loopback device to host the files while they are temporarily decrypted to be read by Octave.

Mike Miller <mtmiller>
Group Member
Mon 15 Jul 2019 04:29:49 PM UTC, comment #1: 

If I got you wrong, please correct me.  As I imagine your scenario, that I understand, I think this will not happen.  Please consult carefully two FAQs of the wiki:

1. Octave is free/libre and open source software.  This is the nature of the GPL to not obfuscate:

https://wiki.octave.org/wiki/index.php?title=FAQ&oldid=12052#How_do_I_run_a_Matlab_P-file_in_Octave.3F

2. If you write software depending on Octave, please make sure, that you do not violate the GPL license terms:

https://wiki.octave.org/wiki/index.php?title=FAQ&oldid=12052#If_I_write_code_using_Octave_do_I_have_to_release_it_under_the_GPL.3F

3. If you earn money using Octave, please consider contributing back.  I've seen you already submitted patches to Octave.  Development power is needed, otherwise jwe would not mind a small tip for all his great effort you benefit from, and your customers as well. https://www.gnu.org/software/octave/donate.html

Kai Torben Ohlhus <siko1056>
Group Member
Mon 15 Jul 2019 02:15:52 PM UTC, original submission:  

Situation


We (and probably others) are using octave from time to time to deploy applications to customers. We are looking for an appropriate method to protect our know how in the deployed scripts and functions. Unlike Matlab, Octave does not provide p-code files yet. Pcode is not encrypted, but just obsfuscated.


Request


I would like to request a new feature in octave (e.g. a special startup option ) that allows reading of encrypted source code files. Encryption method(s) should be state of the art (e.g. BlowFish could be ok).

I think we need to discuss what is the best way to achieve this goal and how this could be implemented. Therefore I would like to start a list of features that should be included and I would be happy about any contribution to it.


Features


  • Octave should decrypt one or more source code files or source code directories or ziped/tared source code files with at least one cryptographic method and at least one key on the fly while interpreting/parsing it.


  • Choose cryptographic method and provide cryptographic key as command line arguments


  • Providing an external program / method to decrypt input files. It is important to have a secure pipeline for transporting decrypted files to octave interpreter. E.g. storing decrypted contents in temporary files would be NOT acceptable.



Contribution


For your contribution a suggest citing the feature list in your comment and modifying/extending it as you think.


Georg Wiora <gwiora>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by godfrey (Posted a comment)
  • -email is unavailable- added by siko1056 (Posted a comment)
  • -email is unavailable- added by gwiora (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only group members can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-07-15 siko1056 Severity3 - Normal 1 - Wish
        Priority5 - Normal 1 - Later
        StatusNone Wont Fix
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code