On Feb 19, 14:25, "David J. Bianco" wrote: } Subject: Encryption in software licenses... } Does anyone have a pointer to any good discussions on how to build programs } with encrypted license keys? ftp.csua.berkeley.edu used to have such a file } (/pub/cypherpunks/cryptanalysis/license.asc.gz), but the archive hasn't } been accessible for a few days. Although I remember this to be mostly about } how to crack such schemes, it has lots of useful information about how they } are designed in the first place. license.asc.gz and some other related stuff is available on ftp://utopia.hacktic.nl/pub/replay/pub/cracking This all goes back to the familiar lesson for all of us reading this newsgroup, the easy way to break most practical applications of cryptography is to find a way to "work around" or "subvert" the cryptosystem being used. Consider two popular UNIX licence managers FlexLM - uses weak cryptography by default to produce licence keys, although vendors can plug in their own Elan (V4.1 and above) - can use DES or a 5-rotor enigma. Both of these are better cryptosystems than that used by FlexLM. Now, does anyone here think that Elan is significantly harder to crack than FlexLM because it uses better cryptography than FlexLM? I hope not. The Elan marketing literature makes the use of DES sound like a big advantage. But, it doesn't make any difference to the cracker. There is actually some good content in the marketing goo at http://www.globetrotter.com http://www.elan.com if you're willing to sift through it. Writing and debugging a floating network licence manager which is reliable and multiplatform is hard. For a real challenge, try and put in some sort of redundancy (multiple hosts), and keep everything sane. The danger for a software vendor is that they end up with a good software product, which has a licence manager that makes it unreliable and causes problems for customers. I've seen this happen a few times. In this senario, customers often abandon the product and stop paying for support and upgrades, which are a significant part of the income of a software vendor. If word gets around (and it will), that your licence manager is buggy will adversely effect new sales. I'm a sysadmin, and every time a licence manager craps out and needs to be restarted, users can't use their software until they can get a hold of me. For some products (I'm not going to mention names), this happens on a more or less weekly basis. Licence manager malfunctions are relatively rare with products like FlexLM and Elan. The home-grown licence managers tend to be a real problem from a systems administration point of view. Here are my free (and worth every penny you paid) recommendations to a software vendor considering some sort of software based licence management scheme. 1. Trust your customers (best choice!!!) and concentrate your efforts on producing good quality software. This way you'll get more customers, etc. Crackers will be able to get around any sort of licence-management scheme anyway (just check out Usenet newsgroups devoted to binary mods to unlock applications and distributing keys for applications) 2. Buy an off-the-shelf licence manager which has a good track-record. It will already have the worst bugs worked out. Better to spend time working on improving the software you are trying to licence. 3. If you must roll-your-own, avoid trying to write a network-floating licence scheme. These are harder to write and have a lot more potential to turn an otherwise good product into a worthless piece of crap. 4. If you must roll-your-own network-floating licence manager, be prepared to expend a lot of time and effort debugging and testing. Be sure to build in some sort of redundancy I mention FlexLM and Elan because I know a fair bit about them. This isn't an endorsement, etc. -- Mark Henderson -- markh@wimsey.bc.ca, henderso@netcom.com, mch@squirrel.com PGP 1024/C58015E3 fingerprint=21 F6 AF 2B 6A 8A 0B E1 A1 2A 2A 06 4A D5 92 46 cryptography archive maintainer - ftp://ftp.wimsey.com/pub/crypto/README.html ftp://ftp.wimsey.com/pub/crypto/sun-stuff/change-sun-hostid-1.6.3.tar.gz