1

I think this is possible but I'm not sure what it's called. I want to find a standard way of doing this (never roll your own).

I have a public/private key and a number of devices on a network. Using (for example) the serial numbers of the devices I want to use the private key to create a value the devices can then validate with their serial numbers and the public key.

So the process would be:

  1. Customer provides list of device serial numbers.
  2. Use private key to create a value and give this back to the customer.
  3. Customer enters this value on the devices.
  4. Each device can then validate its serial number using the public key.

What is this called and are there any standard ways of doing it?

4
  • "Devices can then validate their serial number using the public key." Each device validates its own? Or it validates the other's? Will this "serial number" be used to authenticate the device? – GnP Sep 14 '16 at 17:51
  • Updated the question. – parsley72 Sep 14 '16 at 17:55
  • I'm trying to implement a secure "feature unlock" - the customer provides a list of devices then pays for an unlock code that works on those devices. It needs to be a single code rather than one per device. – parsley72 Sep 14 '16 at 18:17
  • Yes. I'm sure the Product Manager would like a nice short key but I don't see that as being possible, at least not securely. – parsley72 Sep 14 '16 at 20:13
3

It seems you can simply use a signed list of serial numbers.

You get a list of serial numbers, sign it and send it back with the signature. Each device has a copy of the list, the signature and the public key that was used to sign.

The device verifies the validity of the list by veryfing it's signature, and if it's valid it checks the list for the presence of the serial number.

An example using RSA with openssl:

  • On the signing device:

    openssl dgst -sha256 -sign private.key -out serials.sha256 serials.txt
    
  • On the device that needs to validate its serial number:

    openssl dgst -sha256 -verify public.key -signature serials.sha256 serials.txt &&\
    grep "$myserial" serials.txt
    

This isn't bulletproof. You need to ensure the public key can't be swapped and that the validation step on the device can't be bypassed. These are not easy tasks in a complex system.

In other words: this bit will obviously be incorporated in a bigger system. You will need to consider the security of the whole system for this be effective.

Also, be careful not to fall for turing-completeness denialism.

3

I would take a quick look at what a digital certificate is here.

The short:

What you are proposing is basic Public Key Infrastructure. In Large Organizations, they may have their own CA as a Trusted source, primarily because it cost money to use a third party to sign a cert for internal use.

If you customers are external to your business, than I highly advise looking at the Third part signing solution.

What you are most likely trying to accomplish is:

  1. Use the Serial Number of the device as a unique identifier. (See Wiki above).
  2. Create a digital cert signed by a CA.
  3. Use this cert for authentication of the device.

This is more commonly refereed to as Certificate-Based Authentication.

The infrastructure to do this a little tedious for smaller organizations, but their both commercial, opensource. I also direct you to this RedHat doc. You may not be using Linux, but they a great job of discussing the bits and pieces.

3
  • What your describing sounds like I need a certificate for each device. Is there any way of creating a single certificate that covers all the devices? – parsley72 Sep 14 '16 at 17:01
  • @parsley72 Nope. – Luke Park Sep 14 '16 at 19:07
  • As @Luke Park notes, no there is not catch all. If you do an Internal CA vs a Third Party, you also have to setup you devices to have the Internal Trusted CA cert. – Shane Andrie Sep 14 '16 at 19:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.