0

Is it possible to encrypt data server side and then decrypt it client side; without the client having the ability to encrypt the data themselves after decrypting?

I'm working on a license manager which needs to be able to read the contents of the encrypted file, but ideally we don't want the client to have the ability to create their own encrypted license file.

9
  • 2
  • No, the public key will not enough. The client can work on the code and extract the keys.
    – kelalaka
    Nov 27 '19 at 21:46
  • 2
    Could you use a digital signature to meet your goal? The server could sign the license using its private key, then the client could verify the signature using the server's public key. But, the client would not have the ability to sign licenses, being that the client does not have the server's private key.
    – mti2935
    Nov 27 '19 at 22:17
  • 1
    @kelalaka Can you calculate a private key from a public key? If so, please publish the whitepaper.
    – MechMK1
    Nov 28 '19 at 13:18
  • @MechMK1 My point is; the software running on the client machine therefore a dedicated hacker can extract everything. I'm not talking about breaking the public-key cryptosystem, I'm talking about reverse engineering.
    – kelalaka
    Nov 28 '19 at 14:38
1

You are probably mistaking encrypting for signing!

Being able to decrypt something does not imply that the encrypted data comes from a trusted source, which is what you likely want from a licensing software.

Rather, what you should do is to sign the license key, and allow the client to verify the license. This can be done using public-key cryptography. Your server would contain the private key, with the ability to sign data, and your clients would contain the public key, with the ability to verify a signature.

However...

... it should be noted that what you are trying to do is a DRM scheme, and theses schemes are impossible to do with any reasonable guarantee of security, at least if all the "interesting" bits happening on the client.

Your program, in essence, looks like this:

if(license.IsValid())
{
    startTheCoolStuff();
}
else
{
    showLicenseError();
}

You can make this more complicated and throw some obfuscation at it, but it won't change the fundamental nature of the approach. And an attacker, eager to circumvent your licensing, will find a way to execute startTheCoolStuff() without a valid license.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.