I have recently started looking into creating secure, while not validating against an external server, software product keys.
The idea I have had is to create a key consisting of two parts firstly a section that contains some (but not all) details of the user; for example name, customer ID and maybe a salt this would then be ecoded one way or another, say a simple base64 just to obfuscate it. The second part would be an SHA1 signature for a hash of all the user data this would be mostly the same as above but would contain the entitled software version (i.e. 1.0) and maybe something else related to the program.
The deployment of this would work by the user entering the key and the software extracting the user details from the key, appending its own credentials (version number etc.) the generating a hash a verifying the signature using this hash.
If the user key has not been tampered and the user is entitled to user that version of the software all will pass and we can proceed. If this it not the case (say the version entitlement is wrong) the signature will not match the hash. Obviously the public key has to be contained within the software to verify the signature but at no point does the user have the entire hash.
I was discussing this with a friend who said they thought this would be inherently poor as the user could poke through the program find out how the key system works and then, given the structure and the public key generate any number of license keys that would appear valid, as they would control the signature to match the software generated hash of 'fake' credentials.
Is this really that easy to crack surely even if the user did create a hash of some fake details and ID number they could not generate a valid signature to match this? Sorry the question has ended up being much longer than I intended; i wasn't sure how to be clear shorter. I hope this all makes sense.