From what I can tell, some software licenses work client side. For example, when looking in to the purchased software for the first time, the server will return a software license. In order to validate that the license is legitimate, a hash will be calculated over the contents and compare it to the original value in the file.

My question is simply, if the comparison of the hashed value of the contents to the specified value inside the file are equal, the license is deemed true, what prevents creating the file yourself and simply typing in random jibberish, but manually changing the hash value it is comparing itself to such that they're equal. If an algorithm is set in place, would this not pass the validation?

This page demonstrates the diagram nicely. The client could simply change the signature in the file, what prevents the client from changing the digitial signature and changing the contents to match the hash?

  • Well first off, public key cryptography is designed such that you can't change the signature without invalidating it. However in the case of software licenses and DRM, it's often simple enough to toggle whatever bit is used for "signature check passed". DRM is a losing game. – forest May 5 '19 at 22:55
  • @forest Software licenses are that easy to crack? I was thinking so, but what can be done? – J.Doe May 5 '19 at 23:19
  • 2
    Nothing can be done. DRM can always be circumvented. – forest May 5 '19 at 23:20
  • The part where the signer's private key is involved? – user253751 May 6 '19 at 0:25
  • 2
    Typically you don't attack the cryptography of licenses.You attack the software that verifies the license. – vidarlo May 6 '19 at 5:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.