Symmetric algorithms are limited, in that any novice cracker with a disassembler can find your key (or the algorithm used to generate one) and make a "keygen".
For this reason, asymmetric cryptology is the way to go. The basic premise is something like this:
When the user purchases a license from you, you collect certain identifying details about the user and/or their environment (typically, this is just a full name; sometimes a company, too).
You make a 128-bit MD5 hash of this information.
Using a 128-bit Elliptic Curve crypto, encrypt this hash using the private key on the server.
The 128-bit cipher text can be represented to the user as a 25-character string consisting of letters and digits (plus separating dashes for readability). Notice that 26 letters + 10 digits = 36 discrete values, and that 36^25 > 2^128.
The user types this product key into your registration dialog. The client software converts it back to a 128-bit number (16 bytes), decrypts that using the public key of your EC crypto, and compares the result to an MD5 hash of the user's personal information, which must match what was used for registration.
RSA is public key cryptography, involving a public key and a private key, and is fairly slow. The primary use is to set up a secure exchange of a symmetric encryption session key.
AES is symmetric encryption, which is fast and secure.
Since your app does not communicate over public channels and the use of cryptography is limited to product activation/registration you'll want to go with a symmetric cipher. The benefits of public key ciphers is in key management, which you will be handling on your web site or through email.
Note that you do not have to distribute the same key for every customer. You could generate a hash of some of the registration info and XOR it with something else (a fixed session key, perhaps). Send that to the customer, and the program could generate the same hash and XOR will the key you sent to produce the original fixed key.
Dealing with cryptography is not something to be done lightly. As you mention, you expect this to be cracked. If you're doing your own this will almost certainly happen. You can still use your own implementation to "keep honest people honest," but realize that's as far as you'll get. If you need something stronger then you should purchase a solution after doing thorough research on the solutions.
您可以查看这篇代码项目文章。 它描述了基于执行软件的机器的 MAC 地址的软件密钥的实现。 正如作者本人所承认的，该方法并不理想，并且与您正在寻找的有点不同，但也许它可以帮助您。
You can check out this Code Project article. It describes an implementation of a a software key based on the MAC address of the machine where the software is executed. The method is not ideal, as the auteur himself admits, and it is a little bit different from what you are looking for, but maybe it can help you.
发布评论
评论（5）
对称算法是有限的，因为任何具有反汇编程序的新手破解者都可以找到您的密钥（或用于生成密钥的算法）并制作“密钥生成器”。
因此，非对称密码学是最佳选择。 基本前提是这样的：
当然，这只是基本想法。 有关更多详细信息和源代码，请参阅 基于椭圆曲线加密技术的产品密钥。
Symmetric algorithms are limited, in that any novice cracker with a disassembler can find your key (or the algorithm used to generate one) and make a "keygen".
For this reason, asymmetric cryptology is the way to go. The basic premise is something like this:
This is just the basic idea, of course. For more details and source code, see Product Keys Based on Elliptic Curve Cryptography.
如果您只需购买解决方案，生活就会变得更简单。
http://www.kagi.com/kagisolutions/index.php
Kagi 允许您收取付款，他们帮助您管理钥匙。
Life is simpler if you simply purchase a solution.
http://www.kagi.com/kagisolutions/index.php
Kagi allows you to collect payments and they help you manage the keys.
一个人在博客中讲述了他如何处理注册号问题。 他的博客条目之一是 生成唯一注册号。
A guy has blogged about how he handled the question of registration numbers. One of his blog entries is Generating Unique Registration Numbers.
是的，RSA 和 AES 是两种截然不同的东西：
由于您的应用程序不通过公共渠道进行通信，并且加密技术的使用仅限于产品激活/注册，因此您需要使用对称密码。 公钥密码的好处在于密钥管理，您将在网站或通过电子邮件进行处理。
请注意，您不必为每个客户分配相同的密钥。 您可以生成一些注册信息的哈希值，并将其与其他信息（也许是固定的会话密钥）进行异或。 将其发送给客户，程序可以生成相同的哈希值，并对您发送的密钥进行异或以生成原始固定密钥。
处理密码学并不是一件容易的事。 正如您提到的，您希望这个问题能够被破解。 如果你自己做的话，这几乎肯定会发生。 您仍然可以使用自己的实现来“让诚实的人保持诚实”，但要意识到这只是您所能得到的。 如果您需要更强大的东西，那么您应该在对解决方案进行彻底研究后购买解决方案。
Yes, RSA and AES are two very different things:
Since your app does not communicate over public channels and the use of cryptography is limited to product activation/registration you'll want to go with a symmetric cipher. The benefits of public key ciphers is in key management, which you will be handling on your web site or through email.
Note that you do not have to distribute the same key for every customer. You could generate a hash of some of the registration info and XOR it with something else (a fixed session key, perhaps). Send that to the customer, and the program could generate the same hash and XOR will the key you sent to produce the original fixed key.
Dealing with cryptography is not something to be done lightly. As you mention, you expect this to be cracked. If you're doing your own this will almost certainly happen. You can still use your own implementation to "keep honest people honest," but realize that's as far as you'll get. If you need something stronger then you should purchase a solution after doing thorough research on the solutions.
您可以查看这篇代码项目文章。 它描述了基于执行软件的机器的 MAC 地址的软件密钥的实现。 正如作者本人所承认的，该方法并不理想，并且与您正在寻找的有点不同，但也许它可以帮助您。
You can check out this Code Project article. It describes an implementation of a a software key based on the MAC address of the machine where the software is executed. The method is not ideal, as the auteur himself admits, and it is a little bit different from what you are looking for, but maybe it can help you.