Re: PKI confusion...

Remember that signing is similar to encrypting the hash with the private key
so that it can be decrypted with the public key, so if you just need to
encrypt the hash, then perhaps signing gets you close. There may also be a
way you can trick it into signing a hash that is actually a symmetric key in
order to do some sort of bulk encryption.

You really don't want to be thinking in terms of encrypting with the private
key though. It is bad usage and gets you into trouble. This is one of the
reasons MS goes out of their way to prevent you from doing this (there are
also historical legal reasons having to do with export laws). Other crypto
libraries will let you run off and do this, but MS tries to not let you hang
yourself (this time anyway).

It might be beneficial to engage Valery Pryamikov in this discussion as
well, as he knows all the theory and is an expert on licensing and
protecting code assets as well.

http://www.harper.no/valery/

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"Ray Cassick (Home)" <rcassickNOSPAM@xxxxxxxxxxxxxxxx> wrote in message
news:uOyKKLFzGHA.2640@xxxxxxxxxxxxxxxxxxxxxxx

"Joe Kaplan" <joseph.e.kaplan@xxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:uFocnaAzGHA.772@xxxxxxxxxxxxxxxxxxxxxxx
From a cryptography standpoint, you want to always use the private key
for either decrypting data encrypted with the public key or signing data.
In your case, you should be thinking in terms of signing.


We are also looking into signing as well. Thanks.

From a licensing standpoint, I think a lot of the readers of this group
would suggest that rolling your own licensing system is hard to do and
easy to get wrong, and that you'll be better off using a commercial
licensing program. Also know that most licensing systems are easily
cracked by someone who knows what they are doing, so make sure you set
your expectations appropriately about how much protection this will
really give you. If you are thinking in terms of keeping the honest guys
honest, you'll probably be ok.


Thanks for the comments here, and if I was just setting out to build and
use a licensing package I would most likely go that route (buy vs. build)
but I am also looking to market this package as a separate SDK to other
developers. Without giving away any deatils here I think we have some
interesting ideas that can add some significant value to the licensing
market. This is the only reason we are working this project from the
ground up.

We have a prototpye build but it uses symetric encryption right now and
testing has shown that witht he way .NET is, even with obfuscated code,
this opens us up more than we want. We thought that using an asymetric
scheme we would be able to release a key that would allow decrpytion only
while keeping the encryption key safe. Seems not to be the case I guess.




.

Relevant Pages

  • RE: Signing before Encryption and Signing after Encryption
    ... The property that a hash match is supposed to verify (is this ... Signing before Encryption and Signing after Encryption ... Signing with symmetric keys is a lot more ...
    (Security-Basics)
  • Re: Code Signing And Hacking
    ... signing is signing and not ... > encryption. ... When you strong name an assembly, a SHA1 hash is created of your ... hash and public key) is refered to as a digital signature of your assembly. ...
    (microsoft.public.dotnet.security)
  • Re: PKI confusion...
    ... either decrypting data encrypted with the public key or signing data. ... licensing program. ... am also looking to market this package as a separate SDK to other ... keeping the encryption key safe. ...
    (microsoft.public.dotnet.security)
  • RE: Signing before Encryption and Signing after Encryption
    ... If both asymmetric keys are used, the private key needs to be ... This only works if the encryption is NOT transitive, ... If the signing is done over the whole message and not just the ... hash of the message with your private key. ...
    (Security-Basics)
  • RE: Signing before Encryption and Signing after Encryption
    ... I don't understand how a signature can work with a shared key. ... Signing before Encryption and Signing after Encryption ... University program offers unparalleled Infosec management education and the ...
    (Security-Basics)