Encryption in software licenses...

[Mark C. Henderson]

On Feb 19, 14:25, "David J. Bianco" wrote:
} Subject: Encryption in software licenses...
} Does anyone have a pointer to any good discussions on how to build programs
} with encrypted license keys?  ftp.csua.berkeley.edu used to have such a file
} (/pub/cypherpunks/cryptanalysis/license.asc.gz), but the archive hasn't
} been accessible for a few days.  Although I remember this to be mostly about 
} how to crack such schemes, it has lots of useful information about how they
} are designed in the first place.

license.asc.gz and some other related stuff is available on
ftp://utopia.hacktic.nl/pub/replay/pub/cracking

This all goes back to the familiar lesson for all of us reading this 
newsgroup, the easy way to break most practical applications of 
cryptography is to find a way to "work around" or "subvert" the 
cryptosystem being used. 

Consider two popular UNIX licence managers

FlexLM - uses weak cryptography by default to produce licence keys, 
although vendors can plug in their own 

Elan (V4.1 and above) - can use DES or a 5-rotor enigma. Both of these
are better cryptosystems than that used by FlexLM.

Now, does anyone here think that Elan is significantly harder to 
crack than FlexLM because it uses better cryptography than FlexLM? I 
hope not. 

The Elan marketing literature makes the use of DES sound like a big 
advantage. But, it doesn't make any difference to the cracker. 

There is actually some good content in the marketing goo at
http://www.globetrotter.com
http://www.elan.com
if you're willing to sift through it.

Writing and debugging a floating network licence manager which is 
reliable and multiplatform is hard. For a real challenge, try and put 
in some sort of redundancy (multiple hosts), and keep everything 
sane. The danger for a software vendor is that they end up with a 
good software product, which has a licence manager that makes it 
unreliable and causes problems for customers. I've seen this happen a 
few times. In this senario, customers often abandon the product and 
stop paying for support and upgrades, which are a significant part of 
the income of a software vendor. If word gets around (and it will), 
that your licence manager is buggy will adversely effect new sales. 

I'm a sysadmin, and every time a licence manager craps out and needs 
to be restarted, users can't use their software until they can get a 
hold of me. For some products (I'm not going to mention names), this 
happens on a more or less weekly basis. Licence manager malfunctions 
are relatively rare with products like FlexLM and Elan. The 
home-grown licence managers tend to be a real problem from a systems
administration point of view. 

Here are my free (and worth every penny you paid) recommendations
to a software vendor considering some sort of software based licence 
management scheme.

1. Trust your customers (best choice!!!) and concentrate your efforts 
on producing good quality software. This way you'll get more 
customers, etc. Crackers will be able to get around any sort of 
licence-management scheme anyway (just check out Usenet newsgroups 
devoted to binary mods to unlock applications and distributing keys 
for applications) 

2. Buy an off-the-shelf licence manager which has a good 
track-record. It will already have the worst bugs worked out. Better 
to spend time working on improving the software you are trying to 
licence. 

3. If you must roll-your-own, avoid trying to write a 
network-floating licence scheme. These are harder to write and have a 
lot more potential to turn an otherwise good product into a worthless 
piece of crap. 

4. If you must roll-your-own network-floating licence manager, be 
prepared to expend a lot of time and effort debugging and testing. Be 
sure to build in some sort of redundancy

I mention FlexLM and Elan because I know a fair bit about them. This isn't
an endorsement, etc.

-- 
Mark Henderson -- markh at wimsey.bc.ca, henderso at netcom.com, mch at squirrel.com
PGP 1024/C58015E3 fingerprint=21 F6 AF 2B 6A 8A 0B E1 A1 2A 2A 06 4A D5 92 46
cryptography archive maintainer - ftp://ftp.wimsey.com/pub/crypto/README.html
ftp://ftp.wimsey.com/pub/crypto/sun-stuff/change-sun-hostid-1.6.3.tar.gz