I'm a software developer, and I would like to protect my application in an offline way, like many software do activating by phone. Following a screenshot taken from google images on what I would like to achieve:

offline software activation example

I'm interested on how this functionality works from a security point of view. What I've supposed should work like this (please correct me if I'm wrong):

  1. The application generate a random code and shows it to the user
  2. The user phone the application provider and communicate the code.
  3. The company checks the user identity: we can suppose I can securely check the user identity.
  4. The company own a private key, the same stored in the application, so with an internal software concatenates the random code given by the user with the private key, generate a cryptographic hash (e.g. SHA-256 hash sum (SHA-2)) and communicate the result to the user.
  5. After the user insert that code in the form, the application checks that the given unlock code is equal to the one it has internally calculated.

Does it work like this?

  • This is a question about the internals of some specific software, without even saying which software this is. – Steffen Ullrich Nov 27 '15 at 9:08
  • If you are referring the the pasted image, it's just an example taken from the net, I don't know what software is. I'm interested, in general, on how it works software protection done by phone (or by mail). I've just supposed it works as I've written but not sure. – ABCplus Nov 27 '15 at 9:12
  • There are probably various ways how this could be implemented, so there is no general answer. Maybe you should reword your question to ask if the specific idea you present here might work or what problems it might have. – Steffen Ullrich Nov 27 '15 at 9:19
  • Yes it was my intention. I ended the post with: "Does it work like this?" (from a security point of view) – ABCplus Nov 27 '15 at 9:20
  • This is a licensing question, not security. – Neil Smithline Nov 27 '15 at 20:31

The private key won't be stored in the software. If a private key is used, then the corresponding public key will be stored in the software. See Wikipedia - Public-key cryptography.

If you used a symmetric crypto algorithm it would be "easy" to extract the key from the software (security by obfuscation does not count) and calculate the confirmation ID by yourself. Even worse, anyone could provide tools to calculate the confirmation ID.

Hence I would change step 4 and 5 a bit. I would indeed hash the Installation ID and then cipher it with my private key - this is the Confirmation ID. The client would then decipher the Confirmation ID (with the public key) and compare the result with the hash it calculated from the Installation ID. If the hashes match the Confirmation ID is correct.

| improve this answer | |
  • When you talk about "...cipher it with my private key...", what cipher method are you referring to? – ABCplus Nov 27 '15 at 9:26
  • Not one in particular. I think the most popular will be RSA, but it could be any asymetric encryption algorithm, see en.wikipedia.org/wiki/Public-key_cryptography#Examples – Paul K Nov 27 '15 at 9:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.