requesting password creation advice

[stephenprogrammer07]

Hi

I'm trying to make the following solution.
(1) the person would email me their unique Hardware ID.

(2) I would return a matching unlock key, which the person would put in a text file in their directory. The app would pick up the unlock key and go through some simple algorithm to determine if it is complementary to the hardware ID.

I was wondering if someone could give some advice.

(note:
i don't want a for-pat commercial application. I already spent about 300 dollars on EXECryptor and received absolutely no tech support. EXECryptor was a complete waste of money.

I also realize such a solution would be crackable but I just want something very simple. I'm just curious about hearing some ideas. )

I was also wondering if there was some simple open source library I could put in to do this.
I realize also on the simplest level I could make my unlocking key simply every 3 characters of the hardware id but some could easily pick this up.

Thanks
Stephen

[hoxsiew]

Use a hashing algorithm. A cryptographically strong hash like SHA should do fine.

[stephenprogrammer07]

is there a nice code sample some place where i can copy and paste?
I don't have a cs degree. i'm actually in another field now - medsciences.

[hoxsiew]

There's some impelmentation information at the bottom here:

http://en.wikipedia.org/wiki/SHA_hash_functions

Visual C++ 2003 and Windows 2K and later have a built-in crypto API (at least in the US versions).

[stephenprogrammer07]

by any chance, is there some implementation of this code somewhere on the net ?

maybe I have been away from programming for a while -
i see the pseudocode on wiki but just to make sure I get it right the first time, is there some open source implementation already somewhere ?

thanks

[Russco]

Crypto++ should have all you need and much much more.

[hoxsiew]

by any chance, is there some implementation of this code somewhere on the net ?

maybe I have been away from programming for a while -
i see the pseudocode on wiki but just to make sure I get it right the first time, is there some open source implementation already somewhere ?

thanks

What compiler/platform?

[stephenprogrammer07]

dev c++

[hoxsiew]

That's the compiler, not how about the platform?

[Seregwethrin]

I guess DevC++ is only for Windows.

[Paul McKenzie]

dev c++

Dev-C++ is an IDE (Integrated Development Environment) -- it is not a platform and it is not a compiler. The compiler that Dev-C++ uses under the hood is gcc 3.x (look at the compiler messages -- you should see gcc in there). The platform for this version of gcc is Windows.

BTW, Dev-C++ has not been updated in several years, and is basically abandoned. You should think about going to an IDE that is currently updated that supports gcc, and one that comes to mind immediately is CodeBlocks.

Regards,

Paul McKenzie

[andrey_zh]

It looks like some activation scheme...

Well, consider using digital signatures.

Have a look at your hardware ids. You may sign them separately to allow user to change some hardware components.

I.e. the user sends you his hardware ids, you sign them and send signatures back to the user. The program checks signatures and if some (Decide yourself how many) matches it considers itself activated.

Have a look at: http://en.wikipedia.org/wiki/RSA#Signing_messages

It seems me that all necessary stuff is already available in CryptAPI.

Don't blame EXECryptor. It's just used to prevent debugging. But if you are tending to protect something casual UPX is just enough to stop a teenager with SoftICE. (Any program may be disassembled and cracked, it's just a question of time if the program is popular.)

But usage of digital signatures prevents creation of a real keygen.