NOTE: I know that there are numerous topics here on StackExchange about this but I've read them all and this question still persists.
I'm currently working to enhance the security of a windows based application that is sent to specific clients. We use AES encryption to create a big binary file with license data. In this data we have numerous hardware restrictions and things like user name and login. AES keys are stored within the application in a very secure and complicated manner and accessing the keys is done by a "random-based" routine that never uses the same key twice.
So far so good but new policies demand that everything should be signed by an asymmetric encryption scheme. I've being studding RSA and I can totally see how it works for most cases, but in this scenario there's a tiny thing that I still get into my head:
Most posts say that you should sign your license file and send it along with the public key so that it could be verified. So the software doesn't know the privet key, it only has a public key to check the license hash.
Question: What is preventing the user to just sign the license with his key and use his public key to verify it: How does the software can guarantee that the license is in fact made by me and no someone else?
Is more of an conceptual question because is really not clear how this signing will add security at all.
On symmetric encryption the software is build in with information that can decrypt and verify a license. But if the software is depending only on a public key, how does that work?
Thank you all in advance for you time