Suppose I have this scenario:

User --> Inputs License Key --> I validate it --> If success, good, move onto main window. If not, prompt the user to reenter the license key.

The license key will not have activation or hardware ID verification. Just basically enter key and pass or not.

I am wondering about few things when it comes to license key validation.

1) What am I comparing the license key I get from the user to typically when someone performs a license key validation?

How does it determine if the key is valid or not?

What if I had an xml template that included what was needed to generate a key and that xml template had a public key. Would it need to include the private key?

Where in my code/when do I use a private key for validation?

2) After I validate the key and it's valid, I save it inside the datasbase.... If the user reopens the software, do I just do a check to see if a key is stored in the database? How do I perform a daily check to make sure the program is running a valid license? What is typically done in this scenario?

EDIT: More details.

Probably highly insecure but just talking about very basic license key validation using private/public keys.

No hardware ID or activation through server. No License. Just basic check if the key is valid or not.

  • 1
    Is the user always online or is the event expected in a mode that is sometimes offline? How important is counterfeiting via key reuse through software copies distributed to others? Need more details about the client, the user, and the use case. – zedman9991 Aug 8 '14 at 15:22
  • No activation online. The application is expected to run offline. No tying it to hardware id. Anything else? Level of security isn't important. Just a basic implementation is required. Highly unlikely anyone would really distribute this. – Kala J Aug 8 '14 at 15:26
  • So a trivial interaction that does not protect the intellectual property from theft? Why are you challenging the user for a license? – zedman9991 Aug 8 '14 at 16:12
  • Just to provide basic protection. Would you suggest I do instead? This is a very minor application. I'm trying to follow this: softactivate.com/LicensingSDKDocumentation.aspx#Using_Validate and they require a use of a template. – Kala J Aug 8 '14 at 17:32
  • Per the documentation you passed "SoftActivate Licensing Server is a web service which processes product activation requests sent by the products at activation time". So you have to have a license server to challenge the public key with private key information (not available locally to the client) as part of the 'phone home' initialization process. Consider giving them a working executable without this feature. – zedman9991 Aug 8 '14 at 18:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.