An effective method for encrypting a license file?

Question

For a web application, I would like to create a simple but effective licensing system. In C#, this is a little difficult, since my decryption method could be viewed by anyone wi

Answer 1

The only way to provide some sort of security with licensing is to force an online login against credentials hold by yourself (really abstract spoken).

All other methods take more time, and therefore more money, to implement, as to crack and abuse your software instead of buying a license.

.NET has some good cryptographic classes, but as you mentioned, if you are coding the en-/decription of the license, everyone can decompile it easily.

Answer 2

RE: Do not include the whole key in your code. Use sn -p to extract the public part to a file. Use that in your code you distribute to verify the license.

Using the code from the MSDN articles, I created a small app (LicMaker) to facilitate this. The app is signed with the full key pair. The input is an unsigned .XML license file. The output is the original XML + signature in a signed .LIC file. My product is also signed by the same full key pair file as well. The product verifies the .LIC file has not been tampered with. Works Great. I did not use sn -p for this solution.

Answer 3

It sounds like you want to be using Public/Private cryptography to sign a license token (an XML Fragment or file for example) so you can detect tampering. The simplest way to handle it is to do the following steps:

1) Generate a keypair for your company. You can do this in the Visual Studio command line using the SN tool. Syntax is:

sn -k c:\keypair.snk

2) Use the keypair to strongly name (i.e. sign) your client application. You can set this using the signing tab in the properties page on your application

3) Create a license for your client, this should be an XML document and sign it using your Private key. This involves simply computing a digital signature and steps to accomplish it can be found at:

http://msdn.microsoft.com/en-us/library/ms229745.aspx

4) On the client, when checking the license you load the XmlDocument and use your Public key to verify the signature to prove the license has not been tampered with. Details on how to do this can be found at:

http://msdn.microsoft.com/en-us/library/ms229950.aspx

To get around key distribution (i.e. ensuring your client is using the correct public key) you can actually pull the public key from the signed assembly itself. Thus ensuring you dont have another key to distribute and even if someone tampers with the assembly the .net framework will die with a security exception because the strong name will no longer match the assembly itself.

To pull the public key from the client assembly you want to use code similar to:

    /// <summary>
    /// Retrieves an RSA public key from a signed assembly
    /// </summary>
    /// <param name="assembly">Signed assembly to retrieve the key from</param>
    /// <returns>RSA Crypto Service Provider initialised with the key from the assembly</returns>
    public static RSACryptoServiceProvider GetPublicKeyFromAssembly(Assembly assembly)
    {
        if (assembly == null)
            throw new ArgumentNullException("assembly", "Assembly may not be null");

        byte[] pubkey = assembly.GetName().GetPublicKey();
        if (pubkey.Length == 0)
            throw new ArgumentException("No public key in assembly.");

        RSAParameters rsaParams = EncryptionUtils.GetRSAParameters(pubkey);
        RSACryptoServiceProvider rsa = new RSACryptoServiceProvider();
        rsa.ImportParameters(rsaParams);

        return rsa;
    }

I've uploaded a sample class with a lot of helpful Encryption Utilities on Snipt at: http://snipt.net/Wolfwyrd/encryption-utilities/ to help get you on your way.

I have also included a sample program at: https://snipt.net/Wolfwyrd/sign-and-verify-example/. The sample requires that you add it to a solution with the encryption utils library and provide a test XML file and a SNK file for signing. The project should be set to be signed with the SNK you generate. It demonstrates how to sign the test XML file using a private key from the SNK and then verify from the public key on the assembly.

Update

Added an up to date blog post with a nice detailed run through on license files

Answer 4

Wolfwyrd's answer is excellent, but I just wanted to offer a muich simpler version of Wolfwyrd's GetPublicKeyFromAssembly method (which uses a lot of helper methods from the library Wolfwyrd graciously supplied).

In this version, this is all the code you need:

/// <summary>
/// Extracts an RSA public key from a signed assembly
/// </summary>
/// <param name="assembly">Signed assembly to extract the key from</param>
/// <returns>RSA Crypto Service Provider initialised with the public key from the assembly</returns>
private RSACryptoServiceProvider GetPublicKeyFromAssembly(Assembly assembly)
{
    // Extract public key - note that public key stored in assembly has an extra 3 headers
    // (12 bytes) at the front that are not part of a CAPI public key blob, so they must be removed
    byte[] rawPublicKeyData = assembly.GetName().GetPublicKey();

    int extraHeadersLen = 12;
    int bytesToRead = rawPublicKeyData.Length - extraHeadersLen;
    byte[] publicKeyData = new byte[bytesToRead];
    Buffer.BlockCopy(rawPublicKeyData, extraHeadersLen, publicKeyData, 0, bytesToRead);

    RSACryptoServiceProvider publicKey = new RSACryptoServiceProvider();
    publicKey.ImportCspBlob(publicKeyData);

    return publicKey;
}

Answer 5

Use a signed XML file. Sign it with the private key part of a keypair and check it with the public key part in your software. This gives you the oppertunity to check whether the license has been altered and also to check if the license file is valid.

Signing and checking of a signed XML file is documented in the MSDN.

It's of course logical that you sign the license file at your own company and send the license file to the customer who then places the license file in a folder for you to read.

Of course, people can cut out/hack your distributed assembly and rip out the xml sign checking, but then again, they will always be able to do so, no matter what you do.

Answer 6

Why would you need to encrypt it? If it is tampering you are afraid (for instance someone increasing the number of users), could you perhaps just sign it with e.g. your organization's digital certificate instead?