store password secure in INI

[bSecRes]

If you want to encrypt stuff in a way that is reversible then you must have a key or keys. Where is the key to be stored?

The installer compression is necessarily reversible and more or less documented. There isn't a tool for it per se (except the compiled installer itself, which works great). This method cannot be relied upon except to keep the kids out.

The external DLL method. If you have an external DLL that is compiled in such a way as to protect the key safely, fine. This of course means the external dll also performs the encryption and the key never leaves it. This would be used as follows: Call DLL encryption function giving it the clear text. The output of the DLL function is the cipher text. Later you would call the same function to do the reverse. Still, this is a target for hackers. While it is doing its thing in memory someone can try and figure out the key. In this case, that is dangerous because assuming you use the same dll in every installer you distribute, one person cracks it and everyone has cracked it.

The Microsoft method. Security through obscurity. In this protected DLL instead of storing a key, make a thousand (exaggeration?) registry calls get system specific information. In some crazy fashion you would take parts of all of this information and make a key out of it. It is still possible for Joe hacker to figure out the key and possibly though if done properly more difficulty the method for obtaining the key. It just makes it take longer to figure out.

Much better security. If you can assume Internet access exists or if you have an offline channel connecting you and the user of your installer you would use asymmetric cryptography. In this method you would have a public key in the installer that encrypts whatever it is you're interested in protecting. Later, when the user needs to decrypt it, they send the cipher text to your web server or whatever and it return the clear text having decrypted it with the private key on the server. Since the private key is never even on the client's system it is as secure as the server it sits on.

Copy protection schemes that don't rely on hardware devices or users getting challenge text encrypted by a server are always broken. Whether you're trying to do copy protection or something else, if you have the secret that is used to protect something stored in the place where the attacker has access, you are going to get your stuff reversed if the attacker has the time and skill to do it.

Remember key size counts but.. it isn't the size of the key so much as it is how you use it. I guess that applies to a lot of things but...