5

We need to provide a license key to customers for our application. The actual license is XML but we need to encrypt it and then in our program decrypt it. I think it is the following, but am asking to make sure I'm not missing something (the below is updated from encrypting to signing based on the below comments):

  1. On our server create the XML for the key. The key is in the key container on the server.
  2. On our server sign the XML using our private key.
  3. UUEncode the encrypted license so it emails ok.
  4. Email the license to our customer.
  5. The customer puts the license in their app.exe.config file.
  6. The app reads the license from the config file.
  7. The app UUDecodes the license.
  8. The app verifies the signing using our public key. The public key is embedded in the program.
  9. We now have the XML and use the license properties.

Is this the best way to do this? If not, what approach should we take?

If yes, what .NET API should we use for this and are there any links to sample code?

And a giant thank you to all who walked me through this.

17
  • Why not simply send them the XML file?
    – ThoriumBR
    Sep 16, 2014 at 14:21
  • Because if I send an XML file with numServers='2' they can then change it to numServers='2000'. Sep 16, 2014 at 14:24
  • 7
    You don't want encryption, you want signature
    – Stephane
    Sep 16, 2014 at 14:33
  • 2
    Private key is used to DECRYPT data, not encrypt it. If you follow through your plan, you'll need to deploy your private key to all your customers.
    – Stephane
    Sep 16, 2014 at 14:48
  • 1
    @Stephane - Wow, I sure got that backwards. Ok, is there a way where only I can encrypt the key and then the program can decrypt it? But if anyone disassembles the program to get the decrypt key, they still cannot encrypt it? Sep 16, 2014 at 14:50

1 Answer 1

7

Sign Your License File

You want to sign the data with your private key to create a signature.

  1. Generate a license file
  2. Sign the file with your private key.
  3. Provide the public key with your application
  4. In your program, verify the file contents have not changed with your public key.

The signature cannot be replaced since only you have the private key to sign the license. If any piece of the license file has changed then the verification will fail, and you can stop execution of your program. Notify the user as you see fit. The important part to realize is that you're not stopping them from modifying it, but if they do then they invalidate the license.

Encryption is the wrong route to take because no matter what you would have to hard-code the encryption key somewhere in your application. Signing the data is much more secure.

Here is a nice introduction to how signing data works.

Signing Data w/ .NET

I believe this MSDN article will show you all you need to digitally sign an XML file in .NET. There is a full code example at the bottom.

You'll need to create your own RsaCryptoServiceProvider, and setup properties to only contain public keys. Then during installation you'll need to export your public key to the service provider using ExportCspBlob(false). You can export your public key in a well known format like PEM and hard-code it. Here's an example with lots example code for working with encoded strings, creating RsaCryptoServiceProviders, etc.

That last link includes an example that exports the private key as well as the public. You don't want to include this!

3
  • I think this is what I need except... It looks like the same key is used to verify the XML. That means anyone who dissasembles my code can get the key, create their own XML, and sign it. Am I missing something? Sep 16, 2014 at 15:24
  • I'm not an expert on .NET. I would expect during installation you'd have to export the hard-coded public key into your own RsaCryptoServiceProvider. I've updated my answer with some useful (hopefully) links.
    – RoraΖ
    Sep 16, 2014 at 16:05
  • 1
    @RoraΖ "Encrypt the file with your private key (signing it)." Signing and encrypting are 2 very different things. It doesn't really change your answer much, but but it's probably good no not confuse the issue with ambiguous wording. That would go for step 4 as well "In your program, decrypt and verify...". Really all that is needed is the verify bit.
    – jpheldson
    Mar 19, 2016 at 16:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .