0

I got a GUI Program, which loads the Logic from a webserver if the entered License Key is valid.

The actual connection string I hexed and xor'd with a secret key. (which is unfortunately static) The Webservice itself authenticates SASLandSCRAM-SHA-1

For Clearification:

Person A doesn't want to buy a license. So he tries to reverse engineer it:

  • Enters Random False Key - no data from Webservice.

In my understand, the only chance to actually bruteforce the program is to crack the secret key. My thought was creating one dynamically. Besides that, what other approaches are there?

Improve this question
1
  • 1
    You're better off generating a credential on a per license basis, then having the server check if the license is valid (lookup in a database). The program shouldn't authenticate the lice see, it should be the server which checks. That way you can deactivate license keys that get shared.
    – Daisetsu
    Commented Dec 6, 2018 at 20:47

1 Answer 1

Reset to default
1

This is not a secure approach.

In order to use the connection string, the client must decrypt it. In order to decrypt it, it must have possession of the secret key, at least temporarily. During that time, a hacker can debug the program and extract the key from memory. For this reason, a global secret key should never leave your data center.

A more typical approach would be to issue a license code that is hard to guess and simply store it on the server. The caller would need to send the code along with the request to use the service, and the service would check that it is valid. If the code is found to have been compromised (e.g. shared), you can simply remove it from the server.

A less centralized approach would be to issue a license document (e.g. an XML file) and digitally sign it before providing it to the customer. That way the client or other clients could validate the license independently of the server (and of course the server can still validate it).

Improve this answer
1
  • My Database stores the License Keys. :o
    – 0x45
    Commented Dec 7, 2018 at 7:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .