Tag Info

That is not a bad method of doing a license key; an attacker would certainly be unable to generate a signature that would validate with his computer's window product key. On the other hand, this approach may be overkill. The easiest way to attack this system would be to modify the program to skip (or ignore) the signature validation; hackers have both the ...

RSA signatures are designed in a way that only the owner of the private key can generate valid signatures, no matter the message size/length. (There is no proof of this, but RSA would be considered broken if this was not the case.) Your signature is actually a certificate saying The program is allowed to run on a computer with Windows-ID xxx, and if your ...

Since no-one else has mentioned this yet, I guess I should point out that it is possible to use public key signature schemes like (EC)DSA to generate software registration keys. For example, Microsoft apparently uses this for their product keys. Basically, you embed the public key in your program and keep the private key, which you'll use to sign whatever ...

There a number of ways of using block ciphers to produce short ciphertexts: see this post and this post. A general technique is format preserving encryption (FPE). I am not clear on the details of how you want to use it. Is the secret key being distributed with the software so that it can encrypt the username for comparison to the product key you supply?

To begin with, let's assume that the attacker cannot extract the AES key from your software. That means the best they can do is a chosen-plaintext attack on AES: choose a block $Y$, request its encryption $Z$, repeat as many times as desired and try to use the results to figure out something useful about the encryption of other plaintext blocks. Since AES ...

embedding a symmetrical (AES) key in your software really is pointless - an attacker could easily extract the key and generate their own software license key, or worse, create a small program (a crack) that allows other users to generate their own license keys I recommend RSA - generate 'Z' (as per your question) by signing the data 'Y' with a private key, ...

If it's not necessary to think about security, etc, you could do the following: the user sends you the username you calculate the MD5 hash of his same + some salt you choose. Let's say, you do calculate MD5(username + "mySecretSalt"). Let's say the result is "5aa63b07a1a9f0b33d88e719e4cc9f86" you take only the first 4 hex characters. For example, ...