Granny's Programming Pearls
"inside of every large program is a small program struggling to get out"
JavaRanch.com/granny.jsp
The moose likes Other JSE/JEE APIs and the fly likes Licensing using JCE Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login
JavaRanch » Java Forums » Java » Other JSE/JEE APIs
Bookmark "Licensing using JCE" Watch "Licensing using JCE" New topic
Author

Licensing using JCE

Nisha Soorya
Greenhorn

Joined: Dec 01, 2005
Posts: 11
Hi all,

I'm trying to implement a licensing feature to one our products using JCE.

I just need to encrypt some details, create a license key.

My Questions are,

1.How can I store the key by which we are encrypting (if we are using JCE)
2.How can I make the encrypted value (which will include some special characters) to a readable format. (like a HEXADECIMAL or ASCII String)

Thanks

Nish
Ulf Dittmer
Marshal

Joined: Mar 22, 2005
Posts: 41905
    
  63
#1) What are you encrypting - the license key? In that case you need to store the encryption key in plain text somewhere, so you're not gaining much. Maybe I'm missing something?
You could possibly implement an online registration scheme, where a license key is checked live against a database of keys.

#2) There are various ways to do this, e.g. Base64 encoding.
[ December 02, 2005: Message edited by: Ulf Dittmer ]

Ping & DNS - my free Android networking tools app
Nisha Soorya
Greenhorn

Joined: Dec 01, 2005
Posts: 11
Appreciate your help. What I was planning is to encrypt the license key. In my case, online checking is not possible. Do you have any other idea.

I know if I store the key in plain text can be easily found out. And its not a commercial product. What I need to check is the expiry date. Program should not be run, after the expiry date or without a license at all.
Ulf Dittmer
Marshal

Joined: Mar 22, 2005
Posts: 41905
    
  63
Why do you want to embed a license key at all? I would use a system where the correctness of the key entered can be computed by an algorithm. You can use formulas that can be as tricky and obfuscated as you like, so that even from decompiled source code it is not immediately obvious which key would work.
On top of that, I would embed the expiry date into the license key, otherwise it would probably be pretty easy to remove the expiry date check from the decompiled source code.
Nisha Soorya
Greenhorn

Joined: Dec 01, 2005
Posts: 11
I was not talking about storing the license key inside the source code. But the key with I would encrypt the license key. Confusing ?

What I was planning is some thing like, creating a license key, which will include the expiry date. Expiry date will be evaluated by decrypting the license key.

If I'm encrypting the license key using JCE or something, I need to store the KEY (note the license key) with which I'm encrypting the license key right ?
Ulf Dittmer
Marshal

Joined: Mar 22, 2005
Posts: 41905
    
  63
I understand what you're trying to do. But like you say, you need to store the crypto-key in cleartext, so you're not gaining much by using one at all. That's why I suggested not to store the full license key (encrypted or not) in the code, but to use algorithmically checkable license keys. That way you don't have "a" license key, but an algorithm, which you can obscure and obfuscate.
Without an online component, all these attempts merely make it harder for a would-be attacker, though, not impossible. And even with an online component it's ultimately crackable.
[ December 05, 2005: Message edited by: Ulf Dittmer ]
Nisha Soorya
Greenhorn

Joined: Dec 01, 2005
Posts: 11
Greatly appreaciate your help. let me try something as you suggested.


by the way, do you have any idea to prevent the user accessing the product after the license is being expired, by changing the system date ?
Ulf Dittmer
Marshal

Joined: Mar 22, 2005
Posts: 41905
    
  63
I can think of some really involved approaches, but since even commercial software from big companies doesn't handle this one, it's probably not worth your while either.
It's such a nuisance to have to change dates back and forth repeatedly that I can't imagine a sizeable number of people doing that.
 
I agree. Here's the link: http://aspose.com/file-tools
 
subject: Licensing using JCE