LicenseProvider in .NET using RSA encryption to protect product license

Question

Hi there

I'm trying to find a solid licensing scheme using Microsoft's LicenseProvider. My thought is to use asynchronous encryption by ways of RSA (RSACryptoServiceProvider with 2048bit keys). I found this to be pretty easy, but I am unsure how secure the mechanism really is. This isn't for fun and needs to copy-protect a number of products (we're talking ~100 installations) in the US. Expiration date is not needed.

Now, I use a private key to encrypt the license file (.lic). On the customer's computer, the license manager will check the computer's unique ID against the unique ID stored in the .lic file at runtime. Since the product will have the corresponding public key it can decrypt the file. If the IDs match, the license is valid and the program starts.

(BTW the computer ID is a combination of: MAC Address + CPU serial + hard drive serial. So if one of those changes, the license wil need to be renewed)

It's that simple? As I see it, even if you could decrypt the .lic file, you could never encrypt it again because you don't have the private key needed.

Now, other than buying a costly 3rd party solution, cracking and circumventing the licensing DLL, how secure do you find this idea of using RSA+computerID?

(Yes, we're looking into obfuscating the code to make this better)

Thanks for the feedback!

Answer 1

RSA based licensing is very secure. Unless somebody changes your code (and obfuscating will prevent this), it is impossible to generate licenses using a keygen or to tamper with licenses.

You should take a look at CryptoLicensing which uses RSA based licensing scheme along with a ready-to-use LicenseProvider derived class. It also supports hardware-locked licenses that you desire.

Answer 2

I have the same type of solution. However, I just wanted to point out the obsfuscating the code does not prevent revesere engineering and hacking, it just makes the job of understanding the revese engineered code much more difficult. Obsfuscating is an important step in this process because without it, it is relatively easy to reverse engineeer the code, locate the security methods, and just make them return successful results (i.e. No need to spend months trying to crack the encryptin key, a hacker would just bypass it).

Answer 3

Just for clarification, (which you may have been referring to) you should Sign the data using [provider].SignData([params]) and the to validate the license use [provider].VerifyData([params]). Also not forgetting remove the private key from the key pair you have created.