{"action":"closed","issue":{"url":"https://api.github.com/repos/lukevanin/Jigsaw/issues/100","repository_url":"https://api.github.com/repos/lukevanin/Jigsaw","labels_url":"https://api.github.com/repos/lukevanin/Jigsaw/issues/100/labels{/name}","comments_url":"https://api.github.com/repos/lukevanin/Jigsaw/issues/100/comments","events_url":"https://api.github.com/repos/lukevanin/Jigsaw/issues/100/events","html_url":"https://github.com/lukevanin/Jigsaw/issues/100","id":273688436,"number":100,"title":"Digital Rights Management","user":{"login":"lukevanin","id":550579,"avatar_url":"https://avatars2.githubusercontent.com/u/550579?v=4","gravatar_id":"","url":"https://api.github.com/users/lukevanin","html_url":"https://github.com/lukevanin","followers_url":"https://api.github.com/users/lukevanin/followers","following_url":"https://api.github.com/users/lukevanin/following{/other_user}","gists_url":"https://api.github.com/users/lukevanin/gists{/gist_id}","starred_url":"https://api.github.com/users/lukevanin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lukevanin/subscriptions","organizations_url":"https://api.github.com/users/lukevanin/orgs","repos_url":"https://api.github.com/users/lukevanin/repos","events_url":"https://api.github.com/users/lukevanin/events{/privacy}","received_events_url":"https://api.github.com/users/lukevanin/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-11-14T07:07:36Z","updated_at":"2017-11-18T22:00:47Z","closed_at":"2017-11-18T22:00:47Z","author_association":"OWNER","body":"**Problem:**\r\nIt is trivial for an end user to copy original assets content after it has been downloaded to the device.  \r\n\r\n**Mitigation:**\r\n- Encrypt each asset with a unique key. Download the encrypted asset with the purchase.\r\n- Sent the app receipt to the authorization service to download  the decryption key for the asset.\r\n- Store the obfuscated decryption key in the keychain. \r\n- Decrypt the asset at load time using the stored key.\r\n- Store the encrypted asset in the puzzle data file.\r\n\r\n**Attack vector:**\r\n- Get contents of keychain to get decryption key (jailbreak). \r\n- De-obfuscate the decryption key.\r\n- Get the asset file.\r\n- Decrypt the asset.\r\n"}}
{"actor":{"display_login":"lukevanin"}}