End-to-End Encryption (E2EE)

​

Why Use E2EE

• Man-in-the-middle — intercepting and tampering with the response in transit
• Local proxy spoofing — setting up a fake local server that always returns "success": true
• Response sniffing — reading license details, plan info, or activation data

​

Setup

​

Encrypted Response Format

{
  "encrypted": true,
  "payload": "base64-encoded-ciphertext",
  "nonce": "base64-encoded-12-byte-nonce",
  "tag": "base64-encoded-16-byte-auth-tag"
}

​

Decryption Steps

1. Base64-decode payload, nonce, and tag
2. Convert your 64-character hex key to 32 raw bytes
3. Decrypt using AES-256-GCM with the key, nonce, and tag
4. Parse the resulting plaintext as JSON — this is the same response you would get without E2EE

​

Decryption by Language

const crypto = require("crypto");

function decryptResponse(body, hexKey) {
  const key = Buffer.from(hexKey, "hex");
  const nonce = Buffer.from(body.nonce, "base64");
  const tag = Buffer.from(body.tag, "base64");
  const ciphertext = Buffer.from(body.payload, "base64");

  const decipher = crypto.createDecipheriv("aes-256-gcm", key, nonce);
  decipher.setAuthTag(tag);

  let plaintext = decipher.update(ciphertext, null, "utf8");
  plaintext += decipher.final("utf8");

  return JSON.parse(plaintext);
}

import json, base64
from cryptography.hazmat.primitives.ciphers.aead import AESGCM

def decrypt_response(body, hex_key):
    key = bytes.fromhex(hex_key)
    nonce = base64.b64decode(body["nonce"])
    tag = base64.b64decode(body["tag"])
    ciphertext = base64.b64decode(body["payload"])

    aesgcm = AESGCM(key)
    plaintext = aesgcm.decrypt(nonce, ciphertext + tag, None)
    return json.loads(plaintext)

function decrypt_response(array $body, string $hexKey): ?array
{
    $key = hex2bin($hexKey);
    $nonce = base64_decode($body['nonce']);
    $tag = base64_decode($body['tag']);
    $ciphertext = base64_decode($body['payload']);

    $plaintext = openssl_decrypt(
        $ciphertext, 'aes-256-gcm', $key,
        OPENSSL_RAW_DATA, $nonce, $tag
    );

    if ($plaintext === false) {
        return null;
    }

    return json_decode($plaintext, true);
}

local DECRYPT_URL = "http://127.0.0.1:3999/decrypt"

local function DecryptResponse(encryptedBody, callback)
    local payload = json.encode({
        payload = encryptedBody.payload,
        nonce = encryptedBody.nonce,
        tag = encryptedBody.tag,
        key = ENCRYPTION_KEY,
    })

    PerformHttpRequest(DECRYPT_URL, function(statusCode, responseText)
        if statusCode == 200 then
            callback(json.decode(responseText))
        else
            callback(nil)
        end
    end, "POST", payload, { ["Content-Type"] = "application/json" })
end

​

Key Rotation

• A new 64-character hex key is generated
• The old key stops working immediately
• You must update the key in your software and push a new version to your users

​

Security Considerations

​

What E2EE protects against

• Intercepting and modifying API responses in transit
• Setting up a fake local server that always returns "success": true
• Sniffing license details, plan info, or activation data from the network

​

What E2EE does not protect against

• Reverse engineering your compiled binary to extract the encryption key or bypass the check entirely
• Memory dumping at runtime to read decrypted responses
• Patching your binary to skip the verification call

​

Recommendations

• Obfuscate your code — make it harder to read and reverse engineer
• Embed verification deep in your application logic, not in a single easily-patchable function
• Use native compilation (not interpreted scripts) when possible
• Combine license verification with other integrity checks
• Don’t store the encryption key as a plain string — derive it at runtime from multiple values