3

I have a client-side web application running on SharePoint Site Collection, each site collection has it's own unique id. I want to use a licensing process to lock the app to a site collection.

This is the challenge-response process I'm trying to implement:

  • User prompted to generate challenge code
  • challenge code is site_collection_id processed through some function
  • User emails me challenge code
  • I encrypt/hash challenge code with someting (RSA private key?)
  • The encrypted result is considered the license key which I send to user
  • User saves license key into the application

Validation Process:

  • On app load, retrieve license key
  • Decrypt/un-hash license key using something (RSA public key?)
  • The result is the challenge code the user had sent before
  • Compare the challenge code you've generated from the license to the one you'd get from the site to determine if they match

Does this make sense? The one thing I'm not sure about is the public/private key stuff and if there's a way to do this in JavaScript. From what I've read, I can't use RSA securely to encrypt with private key and decrypt with public. It's normally the opposite. So I'm looking for alternatives

Just to be clear, I need to store something in the application script that I can use to decrpyt the license but I'd be encrypting the challenge code either on a different site or server side

I know it's impossible to 100% secure client-side applications. I'm just looking for something to prevent someone from easily distributing the application

Improve this question

1 Answer 1

Reset to default
2

Your scheme is pretty close, i'd say. RSA in JavaScript is a pain in the ass, so look for a library that does it for you. This is my suggestion for your final scheme:

  1. Client sends you the site id i
  2. You sign that id with your private key p: S = RSA-SIGN(i, p) = i^d mod n
  3. You send S back to the client in a file or in an e-mail
  4. Client stores the license file
  5. When the web app loads, download the file (S') and your public key o and do the math: S'' = RSA-VERIFY(S', o) = S'^e mod n. If S'' = S', the license is ok.

The RSA formulas in here are Textbook-RSA and cryptographically insecure. One might recover the private key. So make sure to use proper padding and hashing (keyword: PKCS7)

P.S.: As the TO said, this is not 100% secure. It cannot be since client-side code can be fully tampered with easily.

P.S.S.: I think an online form for steps 1 through 3 would be much better usability-wise than emailing that stuff around.

Improve this answer
4
  • yea eventually I would create an activation site where it could all be automated. So client would signup with purchase number or something, paste in their challenge code or site_id (I prefer using a challenge code instead of their site id for security) then I'd generate a license automatically for them on that activation site and they'd just input that into the app. But that's way in the future.
    – Batman
    Jan 2, 2016 at 23:14
  • Would this only work with RSA? I found this library cryptopjs that has various other encryption options but I'm not sure if they'd fit
    – Batman
    Jan 2, 2016 at 23:19
  • This works with any public-key algorithm that supports signatures, e.g. ECC or ElGamal.
    – marstato
    Jan 2, 2016 at 23:21
  • Okay well I found (this)[github.com/wwwtyro/cryptico] library which seems pretty simple (this stuff is really complex). It seems to support public-key algorithm like you mentioned unlike what the previous one I linked. From their example, I should be able to generate a public key, store it in the application permanently and use that to decrypt the response. Anyways, I'll have to play around with it more and see.
    – Batman
    Jan 2, 2016 at 23:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .