If you issue plain-text license files, what stops an unscrupulous user from opening the file and changing the license count from 10 to 100 by simply tacking on an extra zero, or from upgrading your v2.0 licenses to v5.0 with a quick edit?
Without a strong security approach, nothing stops them. This is where digitally signed licenses come in.
How They Work
With a digitally signed license, your entitlement data (product, version, expiration date, count, etc.) is passed through a signing algorithm to generate a unique, verifiable signature for that data.
When your application loads a license file, it checks both the data and the signature. If the data is ever modified, then the signature for that new data no longer matches the original, rendering the license invalid.
Why Public Key Encryption Beats “Secret Seeds”
Early licensing products used common algorithms that were customized with secret “seeds” to ensure every vendor’s certificate generator could create and validate licenses for its products only.
However, this approach had a flaw: attackers could reverse-engineer or decompile application binaries, extract the secret seeds, and build counterfeit license generators that worked seamlessly with unmodified applications.
Modern licensing solves this issue using public/private key technology:
- Private Key: Resides strictly on your secure build or licensing server to generate and sign licenses. It’s never shipped as part of your software product.
- Public Key: Distributed with your application binary solely to verify the digital signature.
Top comments (0)