# Strategies for securing public key storage on software

I´m kind of new in this so I apologize in advance for any noob mistakes (feel free to point it out)

We are developing a licensing mechanism on our software, and I would like some advice.

The software is installed on premises on the client, good old .Net application. We are planning on using the Portable.Licensing framework, basically, it provides an easy way to generate signed license files, the license file contain all the info the software needs to enable and disable usage and features. To do that, we must generate and use a pair of private/public keys.

As you all may know, we use the private key (and password) to sign the file and the public key to validate the file in the software. A web server would be responsible for creating and delivering these license files to the clients.

So, on my web server we need to have our private key and password. That´s ok and under control.

The question is the public key management, how can I store and secure it on my software in order to guarantee that it will not be replaced?

I am aware that if I put it on the compiled assembly, even if I sign my assembly as well, there is a possibility to crack it. We can always make it more difficult by obfuscating the assembly, but I don´t know if that´s enough.

How would you guys approach this scenario, what´s the best practice? Any input is much appreciated.

Thanks.

• You can't "store and secure it on my software in order to guarantee that it will not be replaced". $\hspace{.74 in}$ – user991 Feb 10 '15 at 13:59
• Is there a safer approach to deliver the public key? I´m open to any kind of suggestion on how to make this safer. – Fedaykin Feb 10 '15 at 14:00
• I certainly don't know of any. $\:$ However, my very vague understanding is that bypassing the signature check is more common than replacing the license verification key. $\;\;\;\;$ – user991 Feb 10 '15 at 14:05
• Obfuscation isn't enough, but that doesn't mean there is something better either. Software DRM inherently relies on security through obscurity. – CodesInChaos Feb 10 '15 at 14:17
• You can't really do that without special things like hardware tokens - and even they could be cracked. People have to execute your software, so they have to have the software openly available. You would have to stop the people to execute the software itself - like with just running the software on your servers and streaming the result to the client, but I can't and don't want to advise this. – Nova Feb 10 '15 at 14:22