GPL. Can source code be modified for security?

Question

I'm currently working on a project that will be given for free under GPL license, for which I have no problem giving the source code. The problem lies in the algorithm used to obtain the private key (to decrypt user data).
Is there a way I can give (when asked to) a modified source code (modified algorithm) that behaves the same to protect user privacy?

I understand that the algorithm can be reversed engineered from the binary file, but its purpose is to provide a small security layer. Also, I don't intend to make money from this, my only concern is user data privacy.

Answer 1

If your project has no GPL/copyleft dependencies (e.g., libraries written by other people licensed under the GPL), then you may do as you please: offer the source code under the GPL, and offer an unrelated binary without corresponding source code available. It so happens that your GPL source code compiles to a binary that somewhat resembles a binary you also offer. So be it; you are the sole copyright holder (or are at least free of others' copyleft requirements) and may do as you please. Simply make it clear that the binary is not licensed under the GPL -- if it were, no one could legally redistribute it, since you did not make the corresponding source available (and so downstream distributors cannot satisfy the requirement to include corresponding source).

If you do use strong-copyleft libraries, then your use of those libraries carries a requirement that, whenever you include that library in a binary, you must make available the full corresponding source for the binary. Offering source code similar to the binary's corresponding source is insufficient.

Personally, as someone with a background in security, I would advise against such a practice generally. Your protocol/crypto/system should be sufficiently strong by itself without relying on security by obscurity. If it is not strong enough, you should select a different one that is strong enough. The fact that such a flimsy security practice complicates your licensing terms is even further argument against it.