@node Filter/decrypt, Filter/exec, Filter/cpp, Module List
@unnumbered template for a decrypt source filter


@unnumberedsec NAME

Filter::decrypt - template for a decrypt source filter

@unnumberedsec SYNOPSIS

@example
use Filter::decrypt ;
@end example

@unnumberedsec DESCRIPTION

This is a sample decrypting source filter.

Although this is a fully functional source filter and it does implement
a @emph{very} simple decrypt algorithm, it is @emph{not} intended to be used as
it is supplied. Consider it to be a template which you can combine with
a proper decryption algorithm to develop your own decryption filter.

@unnumberedsec WARNING

It is important to note that a decryption filter can @emph{never} provide
complete security against attack. At some point the parser within Perl
needs to be able to scan the original decrypted source. That means that
at some stage fragments of the source will exist in a memory buffer.

The best you can hope to achieve by decrypting your Perl source using a
source filter is to make it impractical to crack.

Given that proviso, there are a number of things you can do to make
life more difficult for the prospective cracker.

@enumerate
@item 
Strip the Perl binary to remove all symbols.

@item 
Build the decrypt extension using static linking. If the extension is
provided as a dynamic module, there is nothing to stop someone from
linking it at run time with a modified Perl binary.

@item 
Do not build Perl with @code{-DDEBUGGING}. If you do then your source can
be retrieved with the @code{-Dp} command line option. 

The sample filter contains logic to detect the DEBUGGING option.

@item 
Do not build Perl with C debugging support enabled.

@item 
Do not implement the decryption filter as a sub-process (like the cpp
source filter). It is possible to peek into the pipe that connects to
the sub-process.

@item 
Do not use the decrypt filter as-is. The algorithm used in this filter
has been purposefully left simple.

@end enumerate
If you feel that the source filtering mechanism is not secure enough
you could try using the unexec/undump method. See the Perl FAQ for
further details.

@unnumberedsec AUTHOR

Paul Marquess 

@unnumberedsec DATE

19th December 1995

