![\"software-license\"](\"http:\/\/blog.zoolway.com\/wp-content\/uploads\/2015\/06\/software-license.jpg\")
<\/a>For the solution I decided not to go for a simple key and maybe name input. It would require to build some sort of algorhythm which would not only have to\u00a0validate the key but also check if it has a expiration date or not. If the customer wants more protection attributes like license taker name, device id or more, things get even more complicated.<\/p>\nWhat works very well out there is to have a plain text license agreement which has the necessary information and could contain anything you would like:<\/p>\n
SampleApp License
\nName: Test User
\nExpires:<\/p><\/blockquote>\nThis is human readable and could easily be\u00a0enhanced with more lines with more attributes. Sending the\u00a0license to someone is as easy as\u00a0to send a plain text email. Copy and paste from an email, a website or any other transfer is simple.<\/p>\n
Of course – when you look at this, this is easily to fake. So we need some kind of validation, a secure hash. A hash which can be validated easily but generation is hard and limited to the license giver.<\/p>\n
Implementation<\/h3>\n
Those of you familiar with cryptography will already know what I am after: Asynchronous cryptography to create a signature for the license with a private key which can be validated with a public key. This is not a new idea, it is one of the basic usages of RSA everywhere out there, like the certificates for secured web connections (HTTPS) many of you use for online banking.<\/p>\n
So if we would sign our license, the complete license text could be:<\/p>\n
SampleApp License
\nName: Test User
\nExpires:
\nFJ7xBShqfMqJuvFKdCje6o3pLq7Y9pKC
\nO4D2BSl7vy9jvvUfG9WByEFTgdeSOYSB
\nQShfIs\/4Jm3mErLmE0DElqgivRAmnKHO
\n09RA5B7neiP1KqJOxAfmEBIxMsV9PjhJ
\ntB7s9XQJdkkG1C582imwO\/PCQI9hcbOC
\nmUxj71Iys2c=<\/p><\/blockquote>\nThe trick is: If you change any character here to change your expiration date, name or anything else (even in the hash) the license will be detected to be invalid. This works as the license generator uses a private key to generate the signature hash and your application uses a public key to validate that hash. There are some more things to consider to make this safe but that is the basic idea.<\/p>\n
Does this look similar to you? Yeah, the whole thing is not a new idea to me, there is much software out there already using this kind of approach!<\/p>\n
The implementation of RSA is quite old and well-known. It is based on prime factorisation\u00a0like many cryptography algorithms\u00a0today. And if you would like to do it in .NET, it is even build-in! Unfortunately the web lacks some well-documented example on how to generate a key-pair and how use it for signing and\u00a0validating (and even encrypting and decrypting).<\/p>\n
Use RSACryptoServiceProvider for key generation, import and export<\/h4>\n
So basically, we need to generate a RSACryptoServiceProvider. You can use the default constructor and import\u00a0your RSA settings into the new object or create one with a new keypair with keys of the given size:<\/p>\n
\/\/ generate new keypair with 1024 bit key size\r\nvar csp = new RSACryptoServiceProvider(1024);\r\n\r\n\/\/ create a provider and import Settings\r\nvar csp = new RSACryptoServiceProvider();\r\ncsp.ImportParameters(rsaParams);<\/pre>\n