Backport PCK encryption to Godot 3.x

Describe the project you are working on

2D Singleplayer Mobile game using C#

Describe the problem or limitation you are having in your project

Godot 3.x does not support encrypting PCK files, unlike Godot 4.x.

This is an issue as C# support for exporting to Android & iOS is only present on Godot 3.x. This means we C# users are currently forced to chose between effectively having an open source project (it's very easy to dump Godot games with PCKs that have no encryption see gdsdecomp), or switching to Godot 4.x and using GDScript, thus being able to encrypt our PCK files.

Describe the feature / enhancement and how it helps to overcome the problem or limitation

By backporting this feature, we are:

Not forced to change to GDScript to utilize PCK encryption.
We can protect our revenue from script kiddies attempts.
We can protect our intellectual property from script kiddies attempts.

This feature sets the foundation upon we protect our games. If I add memory protection to my variables is_dlc_owned, it's useless because they will just modify the source directly. PCK protection is this foundation.

I believe pretty much every developer using Godot 3.x would use this feature when it comes time to publish their game. Nobody wants a project that's easy to dump.

"Encryption isn't full-proof, the key is embedded in the binary."

Correct it isn't full-proof. However, with PCK encryption being built-in, and the beauty of the engine being open source, we can modify how the key is used in the encryption algorithm. Thus breaking these dumping tools, as they rely on uniformity (they assume all Godot games are encrypted using the same encryption algorithm provided by the engine, which we are breaking by modifying said algorithm). (See: Protecting your Godot Project from Decompilation by sepTN)

It moves the difficulty from script kiddie, to experienced reverse engineer, and this experienced reverse engineer has to target your game in specific. And when we find out it's been compromised, we could always do an update, changing the encryption algorithm and keys used. Possibly integrating into CI so every build has unique key, etc. A lot of possibilities open up by having this feature. I believe it would move the people targeting your game from the PCK file to runtime memory editing, and this would be the responsibility of the developer to protect against (among other things), if they choose to. Even if the developer stops at PCK encryption, that alone is quite a hurdle to get past especially when mixed with the modified encryption algorithm.

But this relies on the feature being present in Godot 3.x. Without it, we can't take protection into our own hands to anywhere near the same extent, and are forced to choose between protecting our games (switching to Godot 4.x, and using GDScript), or effectively having an open source project (Godot 3.x, which has C# build support for Android/iOS, no PCK support).

Describe how your proposal will work, with code, pseudo-code, mock-ups, and/or diagrams

The Encryption tab in Export would become available, same as Godot 4.x.

Export

If this enhancement will not be used often, can it be worked around with a few lines of script?

I believe it would be used very often for the vast majority Godot 3.x developers.

This can not be worked around with a script, as the PCK generation is handled by the engine.

Is there a reason why this should be core and not an add-on in the asset library?

PCK generation is handled by the Godot Engine, so it's the responsibility of the engine to implement it.

godotengine / godot-proposals