Tag Info

Hot answers tagged

9

In summary: the premise "there is so little space in the bootloader that no cryptographically secure decryption algorithm can be implemented there" is likely wrong; thus security-by-obscurity is not the way to go. The method described in the question attempts to "prevent theft from the publicly released update"; but it fails to do that if an adversary ...


5

That is not a bad method of doing a license key; an attacker would certainly be unable to generate a signature that would validate with his computer's window product key. On the other hand, this approach may be overkill. The easiest way to attack this system would be to modify the program to skip (or ignore) the signature validation; hackers have both the ...


4

RSA signatures are designed in a way that only the owner of the private key can generate valid signatures, no matter the message size/length. (There is no proof of this, but RSA would be considered broken if this was not the case.) Your signature is actually a certificate saying The program is allowed to run on a computer with Windows-ID xxx, and if your ...


4

Take a look at Jerry Sui's Master thesis. It contains the probably most complete and most readable description of AACS.


3

There is no "public" key in AACS (at least, no in the part which uses SDR). Each movie is symmetrically encrypted with a movie-specific key, and stored as is on the disc. All copies of a given movie use the same key; indeed, all copies of a disc are bit-to-bit identical (it would not be economically sound to do otherwise). Two distinct movies, however, use ...


3

I don't think that's possible, at least not without the kind of intrusive mechanisms you'd need for reliable DRM. Basically, if the user gets a key that lets them decrypt the files, what's to stop them from just decrypting them all and keeping the decrypted versions? The only way this could possibly work if you only allowed access to the files through a ...


3

Since no-one else has mentioned this yet, I guess I should point out that it is possible to use public key signature schemes like (EC)DSA to generate software registration keys. For example, Microsoft apparently uses this for their product keys. Basically, you embed the public key in your program and keep the private key, which you'll use to sign whatever ...


2

There a number of ways of using block ciphers to produce short ciphertexts: see this post and this post. A general technique is format preserving encryption (FPE). I am not clear on the details of how you want to use it. Is the secret key being distributed with the software so that it can encrypt the username for comparison to the product key you supply?


1

If it's not necessary to think about security, etc, you could do the following: the user sends you the username you calculate the MD5 hash of his same + some salt you choose. Let's say, you do calculate MD5(username + "mySecretSalt"). Let's say the result is "5aa63b07a1a9f0b33d88e719e4cc9f86" you take only the first 4 hex characters. For example, ...



Only top voted, non community-wiki answers of a minimum length are eligible