License keys are the defacto-standard as an anti-piracy measure. To be honest, this strikes me as (in)Security Through Obscurity, although I really have no idea how license keys are generated. What is a good (secure) example of license key generation? What cryptographic primitive (if any) are they using? Is it a message digest? If so, what data would they be hashing? What methods do developers employ to make it difficult for crackers to build their own key generators? How are key generators made?
当前回答
您可以在使用它的软件项目中非常容易地使用和实现安全许可API(您需要从https://www.systemsoulsoftwares.com/下载创建安全许可的桌面应用程序)。
Creates unique UID for client software based on System Hardware(CPU,Motherboard,Hard-drive) (UID acts as Private Key for that unique system) Allows to send Encrypted license string very easily to client system, It verifies license string and works on only that particular system This method allows software developers or company to store more information about software/developer/distributor services/features/client It gives control for locking and unlocked the client software features, saving time of developers for making more version for same software with changing features It take cares about trial version too for any number of days It secures the License timeline by Checking DateTime online during registration It unlocks all hardware information to developers It has all pre-build and custom function that developer can access at every process of licensing for making more complex secure code
其他回答
您可以在使用它的软件项目中非常容易地使用和实现安全许可API(您需要从https://www.systemsoulsoftwares.com/下载创建安全许可的桌面应用程序)。
Creates unique UID for client software based on System Hardware(CPU,Motherboard,Hard-drive) (UID acts as Private Key for that unique system) Allows to send Encrypted license string very easily to client system, It verifies license string and works on only that particular system This method allows software developers or company to store more information about software/developer/distributor services/features/client It gives control for locking and unlocked the client software features, saving time of developers for making more version for same software with changing features It take cares about trial version too for any number of days It secures the License timeline by Checking DateTime online during registration It unlocks all hardware information to developers It has all pre-build and custom function that developer can access at every process of licensing for making more complex secure code
还有一些DRM行为将多个步骤合并到流程中。最著名的例子之一是Adobe验证其Creative Suite安装的方法之一。使用这里讨论的传统CD Key方法,然后调用Adobe的支持线。CD密钥将提供给Adobe代表,他们将返回用户使用的激活号码。
然而,尽管被分成了几个步骤,但这与正常过程中使用的破解方法相同。人们很快发现了用于创建与原始CD密钥进行检查的激活密钥的过程,并制作了包含这两个密钥的生成器。
然而,这种方法仍然作为一种没有互联网连接的用户验证产品的方式存在。展望未来,随着互联网接入变得无处不在,很容易看到这些方法将被淘汰。
我对人们如何生成CD密钥没有任何经验,但是(假设你不想走在线激活的道路)这里有一些方法可以生成密钥:
Require that the number be divisible by (say) 17. Trivial to guess, if you have access to many keys, but the majority of potential strings will be invalid. Similar would be requiring that the checksum of the key match a known value. Require that the first half of the key, when concatenated with a known value, hashes down to the second half of the key. Better, but the program still contains all the information needed to generate keys as well as to validate them. Generate keys by encrypting (with a private key) a known value + nonce. This can be verified by decrypting using the corresponding public key and verifying the known value. The program now has enough information to verify the key without being able to generate keys.
这些漏洞仍然容易受到攻击:程序仍然存在,可以通过打补丁绕过检查。更聪明的方法可能是使用第三个方法的已知值加密部分程序,而不是将值存储在程序中。这样,在解密程序之前,你必须找到密钥的副本,但一旦解密,它仍然很容易被复制,并且有一个人拿着他们的合法副本,并使用它使其他人能够访问软件。
所有的CD拷贝保护算法给诚实的用户带来不便,同时没有提供任何防止盗版的保护。
“盗版者”只需要获得一张合法的cd及其访问代码,他就可以制作n份拷贝并分发它们。
无论代码的加密安全性如何,都需要以明文形式提供CD,否则合法用户无法激活该软件。
Most secure schemes involve either the user providing the software supplier with some details of the machine which will run the software (cpu serial numbers, mac addresses, Ip address etc.), or, require online access to register the software on the suppliers website and in return receive an activitation token. The first option requires a lot of manual administration and is only worth it for very high value software, the, second option can be spoofed and is absolutly infuriating if you have limited network access or you are stuck behind a firewall.
总的来说,与客户建立信任关系要容易得多!
当我最初写下这个答案时,假设这个问题是关于许可证密钥的“离线”验证。大多数其他答案都涉及在线验证,这明显更容易处理(大部分逻辑可以在服务器端完成)。
使用离线验证,最困难的事情是确保你可以生成大量唯一的许可密钥,并且仍然保持一个不容易被破坏的强大算法(例如一个简单的检查数字)。
我不是很精通数学,但我想到了一种方法,那就是使用一个数学函数来绘制图形
绘制的线可以有(如果使用足够精确的频率)数千个唯一点,因此可以通过在图上随机选择点并以某种方式编码值来生成键
例如,我们将绘制这张图,选择四个点并将其编码为字符串“0,-500;100,-300;200,-100;100,600”
我们将使用一个已知的固定密钥加密字符串(非常弱,但它是有目的的),然后通过Base32转换结果字节以生成最终密钥
然后应用程序可以反转这个过程(从base32到实数,解密,解码这些点),然后检查这些点是否在我们的秘密图上。
这是一个相当少的代码,将允许生成大量的唯一和有效的密钥
然而,它是非常安全的默默无闻。任何花时间分解代码的人都能够找到绘图函数和加密密钥,然后模拟密钥生成器,但它可能对于减缓随意的盗版非常有用。
推荐文章
- 在php中生成一个随机密码
- java.util.Random和java.security. securerrandom的区别
- Docker和安全密码
- 准备好的语句如何防止SQL注入攻击?
- 为什么人们会写“throw 1;<不要邪恶>”和“for(;;);”在json响应前?
- 非加密用途的最快哈希?
- SHA512 vs. Blowfish和Bcrypt
- cer、pvk和pfx文件有什么区别?
- Django设置“SECRET_KEY”的目的是什么?
- 如何从命令行重置Jenkins安全设置?
- 如何通过SFTP从服务器检索文件?
- SecureString在c#应用中实用吗?
- 密码盐如何帮助对抗彩虹表攻击?
- 浏览器会通过https缓存内容吗
- 在git存储库中处理密码的最佳实践是什么?