Tips for securing application with a licence key system?

Question

Hi, I've written an application, and would like to include a licence key system. We do have some requirements, but would like to know what tips you guys have as well.

The main purpose of the system is to make sure we keep track of every customer who has the product, and that we can set the key as invalid if they decide to stop paying.

We want to write it ourselves, not rely on 3rd party libraries.

I realize that a .NET programmer can reflect our app and view the algorithm, but we do not need to secure against those guys. It's not that important.

The licence key must contain an expiration date.

Which algorithms would you use? Any tips?

Answer 1

I use RSA to sign a XML document with a SHA hash. This will ensure the customer does not alter the license info.

You could then assign each license a unique value that would be stored in the XML file and contact your server to validate the license is still valid.

Something like this for the XML hash and signing:

http://www.codeproject.com/KB/security/xmldsiglic.aspx

Answer 2

Brandon Staggs wrote a good article on Implementing a Partial Serial Number Verification System. The examples are written in Delphi, but could be converted to other languages.

Have a look at this related question, where I posted the above answer.

Answer 3

Personally I am a fan of the Steve Gibson licensing algorithm. It's very simple to implement, and creates no burden for your users:

1. Create a kick-ass product. Build value.
2. Just let your users download and run it.
3. Stand behind it. Support it well.

Treat your users like people and not potential criminals and they will compensate you for you work.

(I realize this is heresy for any company that makes software that includes the words "Enterprise", "Edition", or "Professional" in the title. Maybe one day they'll see the light.)

EDIT: Downvote me if you want, I understand that it's not a popular position, and might be considered as "not helping". But I'm of the opinion that any time you sit down to write a licensing algorithm you should take a good hard look at whether or not you really need one.

Answer 4

Take all your license settings, such as username, email, date of expiration, etc and hash it and then use RSA algo to sign it. During validation, hash the settings again and then verify this hash against the signature. Once this is done, verify the settings such as date not expired, etc.

BTW why waste time developing your own, when a licensing system such as CryptoLicensing does all this and lots more! I would want to devote my resources into my core software instead.