Re: RSA private/public question

Nick Rollas wrote:

I want to implement RSA public/key in my software to encrypt my registration keys.

In addition to the implementation advice you have been given already, I would like to stress that such registration schemes can be by-passed. I have seen it happen a number of times.

The problem is that somewhere in your implementation of the registration scheme you will get an if..then statement where you check the validity of the registration entered by the user. This line is exactly what the cracker will try to find. To crack your scheme the cracker will just have to flip the conditional so that execution exits if the key is valid and continues otherwise.

Consequently, you might use RSA to make it practically infeasible for anyone to generate keys that will work with your *authentic* software, but you can't possibly prevent people from generating keys that will work with *cracked* versions of your software. Hence, your best bet might be to give your users incentive to stay away from cracked versions of your software, and one tool you might use for this is a spotless reputation for producing malware free software combined with instrumental use of MS Authenticode. Unfortunately, MS Authenticode signatures are only checked in some circumstances, such as when you are downloading and running ActiveX controls from within MSIE.


--
Henrick Hellström
www.streamsec.com
.

Relevant Pages

  • Re: How to protect my program from being cracked?
    ... Always assume that a detemined cracker has everything, ... generated from system characteristics: hard disk serial numbers, ... processor IDs, OS registration data, application registration data. ... these keys, while in fact it needs only to be able to verify them. ...
    (comp.lang.pascal.delphi.misc)
  • Re: Why use encryption at all?
    ... What if the cracker has not actually gained access to your database, but merely to your data files? ... Encryption will keep him or her from getting your data via a hex editor. ... Or, what if you have multiple keys for different security principals, and the cracker only gains access to one principal? ... The other principal's keys will help protect some of the data so that the cracker can't get everything. ...
    (microsoft.public.sqlserver.security)
  • Re: Encrypting lib.
    ... with the decryption code included. ... That means a cracker could recover all the stored licence keys anyway, because the code would decrypt the keys one by one and compare each with the entered key! ... Sure, if the cracker gets the actual license keys, they can be used by anyone with the authentic software. ... I believe the OP wanted a mechanism that would allow existing customers to use the general distribution of the software with their existing keys. ...
    (borland.public.delphi.thirdpartytools.general)
  • Re: Encrypting lib.
    ... with the decryption code included. ... means a cracker could recover all the stored licence keys anyway, ... Sure, if the cracker gets the actual license keys, they can be used by ... would not only be existing customers, ...
    (borland.public.delphi.thirdpartytools.general)