Member Avatar for lolwtf

We want to use a licensing system for our new software, so we know that our customers are using the same amount of apps that they paid for. The general idea is to get their processor ID and HDD serial number and combine them to make our license string. I want to use RSA encryption, so we can use the public and private keys. Heres how we want it to work:

1. Send customer the installer package.

2. On the load event, generate the numbers.

3. FTP the text file to us.

4. Encrypt the data and store in SQL Server

5. Send them back an encrypted text file(with added information like an expiring date or something at the bottom) and use the key to decode it.

6. I want the keys to be static, so for example, the keyword "DOSTUFF" will decrypt information.

7. I don't want the customers to look at the text file and maybe recognize the RSA pattern and decrypt it, without having the key.

Ive looked at some sample code, but cant seem to find anything. If someone can provide some sample codez, I would be eternally grateful!

Thanks in advance!

  • 3 Contributors
  • 2 Replies
  • 379 Views
  • 2 Months Discussion Span
  • Latest Post Latest Post by ghimangi

Dani AI

Generated

A robust, practical approach is to treat the license file as an authenticated payload (signed) rather than rely on a secret keyword or shipping a private key to customers. The vendor holds the RSA private key and signs a small license record (HW fingerprint, expiry, license ID). The shipped app contains only the public key and verifies the signature, then checks the hardware fingerprint and expiry. A static “keyword” like "DOSTUFF" is equivalent to embedding a symmetric secret in the client and is easy to extract; it should be avoided. As suggested, study basic public‑key concepts; as noted, a ready licensing product can save time if avoiding DIY.

Example server signing and client verification in VB.NET (minimal):

' Server: create signed license (keep private key on server)
Imports System.Security.Cryptography, System.Text

Dim data = String.Join("|", cpuId, hddSerial, expiry.ToString("yyyy-MM-dd"))
Dim dataBytes = Encoding.UTF8.GetBytes(data)
Using rsa As New RSACryptoServiceProvider(2048)
  Dim privateXml = rsa.ToXmlString(True)   ' store safely on server
  Dim sha = New SHA256Managed()
  Dim hash = sha.ComputeHash(dataBytes)
  Dim sig = rsa.SignHash(hash, CryptoConfig.MapNameToOID("SHA256"))
  Dim sigB64 = Convert.ToBase64String(sig)
  ' ship a text file containing the data and sigB64
End Using
' Client: verify signature using embedded public key
Dim pubXml As String = "<RSAKeyValue>...</RSAKeyValue>"
Using rsaPub As New RSACryptoServiceProvider()
  rsaPub.FromXmlString(pubXml)
  Dim hash = (New SHA256Managed()).ComputeHash(Encoding.UTF8.GetBytes(dataFromFile))
  Dim sigBytes = Convert.FromBase64String(sigFromFile)
  Dim ok = rsaPub.VerifyHash(hash, CryptoConfig.MapNameToOID("SHA256"), sigBytes)
  ' if ok, then validate HWID and expiry
End Using

Key practical notes: never send private keys to clients; prefer 2048+ bit RSA or modern ECC algorithms; protect transport (use HTTPS/SFTP, not plain FTP); store only hashed hardware IDs in DB for privacy; plan for key/version rotation and a revocation/checklist or online activation fallback; allow a support path for legitimate hardware changes.

Recommended Answers

All 2 Replies

Member Avatar for ghimangi

The RSA implementation in .Net has some annoying implementations. Have you tried CryptoLicensing which is based on custom RSA implementation and does what you want ?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.