2

This software generates asymmetric encryption using private/public keys portable.licensing. The document states:

Store the private key securely and distribute the public key with your product.

Is there any harm in embedding the public key in the licence itself as an attribute so it's plainly visible to the licence holder?

I'm assuming that anyone who has a copy of the application can easily find any embedded public keys but just wanted to check if there were any drawbacks to making it plainly visible.

Eg:

<License>
  <Id>43946aa3-71ee-498c-a6a3-ffa6f42f6122</Id>
  <Type>Trial</Type>
  <LicenseAttributes>
    <Attribute name="PublicKey">MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEkCipKSjvVZxSa6s1oLJn4A+TP8e9XL2PQmymJiBwR+yi02ZDvVO5YejnWNokyrzg06owL7ErfVh9p71EB8DEMw==</Attribute>
  </LicenseAttributes>
  <Expiration>Wed, 04 May 2016 23:59:59 GMT</Expiration>
  <Customer>
    <Email>email@emailprovider.com</Email>
  </Customer>
  <Signature>MEYCIQDzmcdYdHiT/6mCh33DoNxlFxMgLwxUoKC1HDVTZwdhyQIhAPzgTdh0jQ76zbH3EYzIIAaRjuvIyFqcZZ1tv/G2Kch8</Signature>
</License>
  • 2
    Shoulda called it the "public (yes, public) key" – Neil McGuigan Apr 27 '17 at 19:43
  • only if you want people to be able to send you secure messages. – dandavis Apr 27 '17 at 20:49
1

Sure, public key is included quite frequently as a part of challenge (for example HDCP2). Also there can be a problem to trust of the public key, so it's usually signed with a trusted authority. As public key is used during of the beginning of authentication phase, symmetric keys are not ready at this point.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.