I had an idea on how to create and validate product keys via
online activation. I wondered whether the EXPERT PROGRAMMERS of /prog/
could spot an obvious weakness in it.
Decription follows.
Generating the product key:
1. Generate a secure random 256-bit integer S.
2. Generate four 32-bit integers P0-3 with the following properties:
2a. P0 contains 32 flags indicating permissions of the account, like access to certain content.
2b. P1 may be chosen arbitrarily.
2c. P2 is a unique user ID.
2d. P3 contains the last 32 bits of S
3. Concatenate P0-3 to yield P.
4. Encrypt P using Rijndael (Blocksize 128 bits, Keysize 256 bits) using S as the key yielding K.
5. K is the product key.
Verification:
1. Decrypt K using Rijndael with S as the key yielding P
2. Seperate P into P0-3
3. Compare P3 to the last 32 bits of S. If they don't match, reject the key.
3. Compare P2 to the user's ID. If they don't match, reject the key.
4. Accept the key and set permissions according to P0
You can't even correctly spell separate, how could you possibly think that you could design a key validation system?
Name:
Anonymous2008-09-21 12:44
Looks fine to me, but you realize that it's ultimately useless because unless you need to do this every time you try to access a online service, it's easily crackable, right?
Name:
Anonymous2008-09-21 13:40
This system doesn't provide any authentication. All you'd need to do is find a single key (which can be obtained with a single legitimate purchase) and your system is worthless.
Unless you only allow one install per key, in which case the cure is worse than the disease.
Randomly adding encryption to a system doesn't automatically make it secure.
Name:
Anonymous2008-09-21 13:56
MD5 the product name
MD5 the MD5 50 times
PROFIT
Name:
Anonymous2008-09-21 13:58
>>5
The key will be issued for a specific user ID and should only be usable with this one ID. It is checked in step 3.
Name:
Anonymous2008-09-21 14:07
>>6
No, use this expert encryption function for maximum power.
>>7
If you're already having people sign up for a user account on some central database, why the fuck bother with verifying the software install? Verify the fucking user account.
Name:
Anonymous2008-09-21 14:56
>>9
Because I could offer the service with basic functionality for free and let the users unlock additional features with a key.
Like getting the pics for free but having to pay for the videos.
Or whatever the online service may offer.
I agree with >>9 -- the Spore DRM, for example, is fucking retarded. You have to jump through a shitload of hoops to just run the fucking binary, and then you have to sign into the game using a username/password. If they had just locked off the online content to authenticated users only and made the binary itself free, it might have been more reasonable.
There is always a crack -- that's how the light gets in.
Name:
Anonymous2008-09-21 17:20
>>10
It's a stupid idea. DRM never works, and it won't work in this case. The people who are likely to use most of your bandwidth are also going to be the ones who have access to cracks.
1) Find verification step 1 code
2) Replace with a JMP to step 4 code with permissions set to 0xffffffffffffffff
Name:
Anonymous2008-09-22 1:09
>>1
All of the other criticisms aside, what's the point of generating a 256-bit integer and using a 256-bit key to produce a 128-bit product key?
Name:
Anonymous2008-09-22 1:12
>>20
To make it more secure? In any event, here's a small perl fragment which implements the OP's product key system. Currently, perl doesn't have any good Rijndael modules, so I had to settle for AES (same shit).
Usage: perl key.pl <binary string representing capabilities>
Eg. perl key.pl 10001101
$_="=]=>%-|{<-|}<&|`{";
tr~ -/:-@[-`{-}~`-{/" -~;
eval $_;
>>21 To make it more secure?
Protip: when it's easier to bruteforce the result than it is the key, it's not ``more secure''. It's just wasted clock cycles.
Currently, perl doesn't have any good Rijndael modules, so I had to settle for AES
Ah, that explains it. You don't know shit about cryptography.
Name:
Anonymous2008-09-22 1:45
>Ah, that explains it. You don't know shit about cryptography.
Did you find anything wrong with the implementation?
Currently, perl doesn't have any good Rijndael modules, so I had to settle for AES
I lol'd irl.
Name:
Anonymous2008-09-22 2:11
>>21,24 here.
After reading up on AES and Rijndael, I feel a bit silly now, please disregard my posts. I thought they were different.
Good thing this is 4chan, hahaha.
Name:
Anonymous2008-09-22 3:21
>>19
Wont' work unless you can execute code on the server.
Name:
Anonymous2008-09-22 3:37
>>28
Maybe I'm missing something here, but in your program wouldn't you have code which looks like:
get user key
send key to server
receive reply from server
if (key verified)
proceed_as_normal()
else
bad_key()
Name:
Anonymous2008-09-22 3:40
PROTIP: If Microsoft aren't able to make a crack-proof online activation scheme, some shlub from /prog/ has an extremely low likelihood of doing so.
Name:
Anonymous2008-09-22 7:14
>>30
The only competent programmer at Microsoft is Gates himself, and he hasn't written a line of code in fifteen years.
Name:
Anonymous2008-09-22 8:03
❝Using a simple three-line piece of code, Eller drew a round digital clock on the computer screen. It looked too plain. Using an instruction known as a flood-fill algorithm, he tried to fill in the background with colour, but it didn't work. Eller flipped through the manual, trying to figure out if he had done something wrong. He called his boss.
'Why isn't the flood-fill working, Greg?'
'Must be a bug in your code, Marlin.'
'No, I've already been over my code. There aren't any bugs.'
'Not in your code,' Whitten said. 'In the Basic code.'
'You mean we ship our Basic with bugs in it?' Eller asked, somewhat incredulously.
'That's right.' And with that, Whitten walked out of the room.
Slightly disgusted that he had just joined a company that was shipping defective software, Eller decided to take matters into his own hands, taking two weeks to hack out a new flood-fill algorithm.
Whitten was less than thrilled. The two weeks on the flood-fill were at the expense of the translator he was supposed to be writing. Undaunted, Eller set out to let others in on the flaw he had discovered and how he had fixed it. He even pulled in Chairman Gates, whose office was just down the hall.
'Bill, check this out,' Eller said, pointing to his computer screen.
'I mean ... who was the jerk who wrote this brain-dead piece of code?'
Gates stared at the screen.
'See, that's what I call a design flaw,' Eller said. 'Now check out my new version. Pretty cool, eh?'
Gates nodded, pushing his glasses up the bridge of his nose. Gates told Eller his program was nice, then turned and walked back to his office.
After Gates left, Whitten walked into Eller's office. He had heard the entire conversation.
'Do you know who wrote the original flood-fill algorithm?' he said, shaking his head.
'Ahhh, nope,' Eller replied. 'I don't believe I do.'
Whitten paused, rubbed his finger on his left temple, and shook his head again. 'Bill wrote it,' he said. 'Bill was the jerk who wrote this brain dead piece of code!'❞