Brainstorm about Serial key generation

[Alter88]

Hello,

I'm trying to secure my program with a serial key. Just like office or windows.

When I, i.e, have a code in the form xxxxx-xxxxx-xxxxx-xxxxx I could check if every xxxxx meets some rule, like divided by a certain number, but I think it's not safe enough.

An other option is to encrypt the code with TEA, SHA, DES or something like that. But in order to use these encryptfunctions you have to implement them in your program, else you cannot check if the key the user enters is correct. But if you do this people can reverse engineer the program and reveal the algorithm, or am I thinking to simple?

Does anyone have experience with this and wants to help me with this?

[spoulson]

Use private key encryption. This way, the algorithm and public key can remain in your code, but the private key secured on your end to be used your key generator tool.

In short:
Generate private/public key pair using algorithm of choice.
Serial key will have some data, such as validity date, # licenses, etc.
Use private key is used by algorithm to encrypt this data (known as a crypt).
Crypt data is encoded for ease of use into ASCII string, such as Base64, to create your encrypted key string.
When key string is loaded into software, the software may use the matching public key you generated to decrypt and reveal the underlying data.
The public key is not usable for re-encrypting.

This design won't guarantee a fixed-length string for a key, but I'm sure there's several ways you can modify the concept to do it.

[dglienna]

Search for CAPICOM. It's easy to use and versatile.

[spoulson]

...Even better.