License keys are the defacto-standard as an anti-piracy measure. To be honest, this strikes me as (in)Security Through Obscurity, although I really have no idea how license keys are generated. What is a good (secure) example of license key generation? What cryptographic primitive (if any) are they using? Is it a message digest? If so, what data would they be hashing? What methods do developers employ to make it difficult for crackers to build their own key generators? How are key generators made?


当前回答

您可以在使用它的软件项目中非常容易地使用和实现安全许可API(您需要从https://www.systemsoulsoftwares.com/下载创建安全许可的桌面应用程序)。

Creates unique UID for client software based on System Hardware(CPU,Motherboard,Hard-drive) (UID acts as Private Key for that unique system) Allows to send Encrypted license string very easily to client system, It verifies license string and works on only that particular system This method allows software developers or company to store more information about software/developer/distributor services/features/client It gives control for locking and unlocked the client software features, saving time of developers for making more version for same software with changing features It take cares about trial version too for any number of days It secures the License timeline by Checking DateTime online during registration It unlocks all hardware information to developers It has all pre-build and custom function that developer can access at every process of licensing for making more complex secure code

其他回答

当我最初写下这个答案时,假设这个问题是关于许可证密钥的“离线”验证。大多数其他答案都涉及在线验证,这明显更容易处理(大部分逻辑可以在服务器端完成)。

使用离线验证,最困难的事情是确保你可以生成大量唯一的许可密钥,并且仍然保持一个不容易被破坏的强大算法(例如一个简单的检查数字)。

我不是很精通数学,但我想到了一种方法,那就是使用一个数学函数来绘制图形

绘制的线可以有(如果使用足够精确的频率)数千个唯一点,因此可以通过在图上随机选择点并以某种方式编码值来生成键

例如,我们将绘制这张图,选择四个点并将其编码为字符串“0,-500;100,-300;200,-100;100,600”

我们将使用一个已知的固定密钥加密字符串(非常弱,但它是有目的的),然后通过Base32转换结果字节以生成最终密钥

然后应用程序可以反转这个过程(从base32到实数,解密,解码这些点),然后检查这些点是否在我们的秘密图上。

这是一个相当少的代码,将允许生成大量的唯一和有效的密钥

然而,它是非常安全的默默无闻。任何花时间分解代码的人都能够找到绘图函数和加密密钥,然后模拟密钥生成器,但它可能对于减缓随意的盗版非常有用。

请查看关于部分密钥验证的文章,其中包括以下要求:

License keys must be easy enough to type in. We must be able to blacklist (revoke) a license key in the case of chargebacks or purchases with stolen credit cards. No “phoning home” to test keys. Although this practice is becoming more and more prevalent, I still do not appreciate it as a user, so will not ask my users to put up with it. It should not be possible for a cracker to disassemble our released application and produce a working “keygen” from it. This means that our application will not fully test a key for verification. Only some of the key is to be tested. Further, each release of the application should test a different portion of the key, so that a phony key based on an earlier release will not work on a later release of our software. Important: it should not be possible for a legitimate user to accidentally type in an invalid key that will appear to work but fail on a future version due to a typographical error.

您可以在使用它的软件项目中非常容易地使用和实现安全许可API(您需要从https://www.systemsoulsoftwares.com/下载创建安全许可的桌面应用程序)。

Creates unique UID for client software based on System Hardware(CPU,Motherboard,Hard-drive) (UID acts as Private Key for that unique system) Allows to send Encrypted license string very easily to client system, It verifies license string and works on only that particular system This method allows software developers or company to store more information about software/developer/distributor services/features/client It gives control for locking and unlocked the client software features, saving time of developers for making more version for same software with changing features It take cares about trial version too for any number of days It secures the License timeline by Checking DateTime online during registration It unlocks all hardware information to developers It has all pre-build and custom function that developer can access at every process of licensing for making more complex secure code

对于老式的CD键来说,这只是一个容易生成和验证CD键(可以是任何字符串)的算法的问题,但是有效CD键与无效CD键的比例是如此之小,以至于随机猜测CD键不太可能得到有效的CD键。

错误的做法:

《星际争霸》和《半条命》都使用了相同的校验和,即第13个数字验证了前12个数字。因此,您可以为前12位输入任何数字,并猜测第13位(只有10种可能),从而得到臭名昭著的1234-56789-1234

验证算法是公开的,看起来像这样:

x = 3;
for(int i = 0; i < 12; i++)
{
    x += (2 * x) ^ digit[i];
}
lastDigit = x % 10;

正确的方法

Windows XP收集了相当多的信息,对其进行加密,然后将字母/数字编码放在贴纸上。这允许MS同时验证您的密钥并获得产品类型(家庭、专业等)。此外,它需要在线激活。 完整的算法相当复杂,但在德国发表的这篇(完全合法的!)论文中很好地概述了它。

当然,无论你做什么,除非你提供的是在线服务(如《魔兽世界》),任何类型的版权保护都只是一种拖延:不幸的是,如果这是一款有价值的游戏,就会有人破坏(或至少绕过)CD-key算法和所有其他版权保护。

真正正确的做法:

对于在线服务来说,情况要简单一些,因为即使使用二进制文件,你也需要通过服务器的身份验证才能使用它。拥有一个WoW账号)。魔兽世界的CD-key算法——例如,在购买游戏卡时使用——可能看起来像这样:

生成一个非常大的加密安全随机数。 储存在我们的数据库中,并打印在卡片上。 然后,当有人输入游戏时间卡号时,检查它是否在数据库中,如果是,将该号码与当前用户关联,以便它永远不会再被使用。

对于网上服务,没有理由不使用上述方案;使用其他任何方法都可能导致问题。

所有的CD拷贝保护算法给诚实的用户带来不便,同时没有提供任何防止盗版的保护。

“盗版者”只需要获得一张合法的cd及其访问代码,他就可以制作n份拷贝并分发它们。

无论代码的加密安全性如何,都需要以明文形式提供CD,否则合法用户无法激活该软件。

Most secure schemes involve either the user providing the software supplier with some details of the machine which will run the software (cpu serial numbers, mac addresses, Ip address etc.), or, require online access to register the software on the suppliers website and in return receive an activitation token. The first option requires a lot of manual administration and is only worth it for very high value software, the, second option can be spoofed and is absolutly infuriating if you have limited network access or you are stuck behind a firewall.

总的来说,与客户建立信任关系要容易得多!