I'm a software developer, and I would like to protect my application in an offline way, like many software do activating by phone. Following a screenshot taken from google images on what I would like to achieve:
I'm interested on how this functionality works from a security point of view. What I've supposed should work like this (please correct me if I'm wrong):
- The application generate a random code and shows it to the user
- The user phone the application provider and communicate the code.
- The company checks the user identity: we can suppose I can securely check the user identity.
- The company own a private key, the same stored in the application, so with an internal software concatenates the random code given by the user with the private key, generate a cryptographic hash (e.g. SHA-256 hash sum (SHA-2)) and communicate the result to the user.
- After the user insert that code in the form, the application checks that the given unlock code is equal to the one it has internally calculated.
Does it work like this?