To prevent user from downloading bootleg copies of software , users often have to enter a string of hexadecimal numbers which would be used to authenticate the user.

I think the basic idea would be that that the secret key is embedded in the software and a successful authentication occurs when there is a match between the user entered string and the secret key.

I would like to know the actual mechanism behind this idea

What are some other possible mechanism used when the software does not require internet connection to authenticate ??


NB: Not sure if this is the correct site for this question , please transfer question to appropriate site where necessary

1 Answer 1


Your question is a little bit confusing, so I'm not exactly sure what your asking, but I'll have a go.

Sometimes, when you download software, there will be information provided which often looks like a long hex value and sometimes referred to as a checksum or signature. This is a unique value generated by using the software as input to a hashing or checksum function. The output from this process is guaranteed to be the same provided the input is exactly the same. If the input has been changed in any way, the output value will be different. This is essentially an integrity check. If I was making software available for download, I might include this information along with details of how it was generated i.e. SHA1, CRC-32 etc. With that information, you can then use a program to generate the signature or checksum from the downloaded version of the software and see if you get the same value. If you do, then you can be confident the software has not been modified (either by accident during download or by someone being a bit more malicious).

The other place you will see things which can look a bit like a hex string is with software license keys. These are used to ensure that the person using the software is licensed to do so. There are a few ways this can be implemented. For software which is going to be used in an off-line scenario, the general approach is a long key which the software can verify as being a legitimate license key. The key might have a mixture of components, some of which can be verified off-line while others may only be verified on-line or it just might be a very simple algorithm where it just checks that certain bits of information are all in there and in the right position. With an off-line verification, you need to have an approach that doesn't rely on specific user details as there is no way to verify such details. In this case, the verification process is likely just verifying that the key has necessary elements or structure. Normally, the key will be long enough that guessing a valid key is very difficult with a very low probability. Long keys also make it harder for people to share keys, but this is one of the limitations of off-line key verification. With on-line key verification, it is possible for the software to send a query off to a central database which tracks license key use. This database may even record associations of the software and key to prevent the key being used with multiple instances of the software.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .