security
Can I distribute instructions on how to extract a private key?
<p>I asked this question <a href="https://reverseengineering.stackexchange.com/questions/12247/can-i-distribute-instructions-on-how-to-extract-a-private-key?noredirect=1#comment17306_12247">over on the reverse engineering Stack Exchange</a> but was told to post it here instead, even though I felt the question didn't really fit here.</p>

<p>To recap, I'm writing some (open source) software that talks to some hardware. The communication is encrypted, but I managed to find the encryption key in their app. I know I can't distribute the key, but can I give people instructions on how to find the key?</p>

<p>I was planning on making it step-by-step (e.g. "go to app-downloader.example.com, type in 'com.example.app', download the file, upload it to app-decompiler.example.xyz and look in path/to/private.key"), but also wondered itf it was better to scale it back (e.g. "download the app, decompile it, look in there for the password").</p>

<p>I plan to chat to a lawyer when it comes closer to release time, but for now, I'd like to know if I should put the effort in documenting the process or not.</p>

<p>EDIT: To further clarify, my app's purpose is to achieve interoperability, or in this case, operability. The app which houses the private key is literally unusable -- I've made 30+ attempts and tried three different phones and their app won't connect to their hardware. Many others are experiencing the same (1.6/5 stars on Google Play, 16 1-star reviews out of 24 total). Early signs tells me that my code could connect, providing I can encrypt and decrypt the information necessary. Support is non-existent (they stopped replying to comments mid last year, and no updates in that long either).</p>

<p>U.S. Code § 1201 - Circumvention of copyright protection systems tells me that:</p>

<blockquote>
  <p>Notwithstanding the provisions of subsection (a)(1)(A), a person who has lawfully obtained the right to use a copy of a computer program may circumvent a technological measure that effectively controls access to a particular portion of that program for the sole purpose of identifying and analyzing those elements of the program that are necessary to achieve interoperability of an independently created computer program with other programs, and that have not previously been readily available to the person engaging in the circumvention</p>
</blockquote>

<p>So as far as I can tell, I'm within my rights to create the code, as my goal is to achieve interoperability, by letting users control this hardware (a Chinese version of a Belkin WeMo WiFi switch) with their home automation system.</p>

<p>So my goal isn't to "stand outside a bank at midnight and offer to give away the access code to the front doors", but rather to stand out the front of a bank during opening hours and show them how to operate the door when they can't get in, and the bank refuses to fix the door.</p>

<hr>

<p><strong>EDIT 2</strong>: Since then, I've discovered that I can make this key extraction process even more generic. The app can be freely downloaded from their website. If I download it, read a single file in there and tell my computer to find anything that is 16 alphanumeric characters long in that file (the encryption type they use states that the password MUST be 16 characters long), then it can find it.</p>

<p>So now that's what I'm attempting to focus on, because I don't need to distribute anything, I just need to write code to download the file from their public website, pull out all the 16-character long strings from the file (there are a few) and try each key until the correct one is found.</p>

<p>So it's a confusing conundrum.  In the United States, it's illegal to talk about bomb making for the purposes of committing a criminal act, but it's not illegal to discuss making the same bomb for an academic purpose (discussing the manufacture of a bomb for a terrorist attack you are going to commit is bad.  Discussing how Timothy McVeigh designed his bomb for maximum damage in the Oklahoma City Bombing is good.)   If someone takes knowledge gleaned from the latter situation and uses that knowledge in the former situation than it's probably going to get uncomfortable questions from the investigators, but you are not the bomber, nor was your intent malicious.</p>

<p>More to your own concern, I was once considering a course in hacking techniques from a professor I enjoyed (ultimately it was an elective that wasn't scheduled) and he explicitly told the group that when he has taught it he's made it explicitly clear that they were on their own if they actually used any of the techniques taught in the course for an actual computer crime.  This was just advanced demonstration of how to both do this stuff and thus what signs to look for.</p>

<p>No, you can not tell people how to break the encryption. The encryption is a form of DRM and is protected under the Digital Millennium Copyright Act. For a while, hacking your own device was illegal under that law, but doing it on your own device is now considered legal. 
<a href="https://www.extremetech.com/electronics/279575-its-now-legal-to-hack-drm-on-your-devices-to-fix-them" rel="nofollow noreferrer">https://www.extremetech.com/electronics/279575-its-now-legal-to-hack-drm-on-your-devices-to-fix-them</a></p>

<p>Telling others how to do it, would not fall under the exemption that allows you to modify your own devices, since you would be decimating a way to break encryption even if you do not break it yourself.</p>

<p>I am not a lawyer.</p>

<p>Albeit a different take on issue, but why not just distribute the private key, but not indicate how the key is used?</p>

<p>Facts are not copyrightable, see <a href="https://law.stackexchange.com/a/2177/917">this answer</a>. As long as you do not aid in copyright infringement, distributing a fact like the private key in this piece of hardware is this pair of numbers and it uses this algorithm for encryption is most likely legal and probably protected under the first amendment. Of course, asserting this could involve significant legal expense, but some states have legal provisions to prevent abuse of the courts in attempt to stop protected speech which help significantly defray costs.</p>

<p>Additionally, describing the factual process by which the key was obtained is also likely protected by the first amendment. Of course in doing so you may admit to other criminal/civil violations and the product of these violations would of course not be protected in that case.</p>
