I’ve spent a couple of days researching the topic of creating a license system for my desktop software. While I fully understand that there’s no perfect copy protection, this approach seems to have the best balance for me. There are a couple of details that I can’t fully get my head around before starting with the implementation. I’d really appreciate if you could share your thoughts on the following topics:
1. Encrypt or Sign? (answered -> sign)
In my understanding both encrypting and signing the license information on my server-side with my private key would work. The desktop client would either have to decrypt or verify the signature of the license text-file with the embedded public key. The only difference I see is that in the latter case the content of the license file is humanly readable while the encrypted version is not. Would you rather encrypt or sign the license file? Why?
2. Hash or directly encrypt/sign the License? (answered -> signing automatically hashes it)
Let’s say the license information text consists of about 300 bytes. Would you recommend to sign/encrypt it directly, or hash it and then sign/encrypt the hash? I’m asking this because I’ve read different statements that asymmetric encryption isn’t suitable for large data. But what’s the limit?
3. Revoke a License?
What’s the best way to revoke an already issued license? I understand that having an online blacklist is probably the most accurate solution, however I don’t want the software to be dependent on an Internet connection and the reliability of my server. So I guess the alternative is to have black-listed licenses within the application being maintained with new releases? In that case what exactly would I create a list of? The signed/encrypted license (probably too big with a growing list)? A hash of it? Something completely different?
Edit: Combining the replies so far I guess the first two questions can be combined to "Sign it and don't care about the content length".
The third question however remains unclear to me. I'd like to point out that I don't want to have a dependance on an online server for not bothering honest customers. After all forced online connections bring more annoyance than security. So there needs to be kind of an "offline solution", even if less secure. Please reconsider question #3 under this aspect.
Actually I'd even like to extend question #3 by the following scenario:
4. Replace stolen/hacked private key In a worst case scenario the private key might get stolen or somehow hacked, so the attacker is able to create a license generator himself. What would I have to do in this case? I can't blacklist some licenses like in #3, so instead I'd have to replace the key pair, wouldn't I? However in my understanding that would also mean that all customers would require to receive new licenses when updating to a new version with the replaced public key. Is there some clever solution for only blacklisting licenses with the old key pair that have been created after a certain date so the already created licenses before some date stay intact? I understand that it'd require some kind of timestamp system that an attacker can't fake. Is there such a thing?