Re: Public-key CD-KEY protocol (comments welcomed)

From: Mark Borgerding (mark_at_borgerding.net)
Date: 02/01/04

  • Next message: John Savard: "Re: New Encryption Mode" 
    Date: Sun, 01 Feb 2004 16:01:43 GMT

    I think there's a better way of handling your CD-key problem.

    Simple. No ciphers needed. No multiple stages.

    1. Generate completely random CD keys on a trusted off-line system.

    2. Create a database of the hashes of each CD key. MD5 or SHA1 should do
    nicely.

    3. Copy the database to your on-line verification server.A sorted file
    would work well too if you don't want to add a db.

    4. To verify a CDkey, the ver. server just checks to see if the hash is
    in its database. If the hash is present, then the key is good.

    To add more CD-keys, simply repeat steps 1&2, then merge the database.

    If the verification server is compromised, so what -- rebuild it? The
    database is next to useless to an attacker.

    The only thing he can do with the db is a dictionary attack. Since the
    CDkey will have ~125 bits of entropy (base32,25 chars), this will
    probably be a less economical way of getting CDkeys rather than just
    buying them from you :) You could use salt to make an attackers life
    even more difficult. But any multiplication of the attackers work would
    also multiply your work, since you'd have to try all possible salts.

    If you are really paranoid, you might even be able to fit the
    verification server onto a bootable CD.

    It is quite possible I've missed something, since I spent only as much
    time thinking about it as it took to make breakfast. Let me know if
    this works for you.

    - Mark Borgerding

  • Next message: John Savard: "Re: New Encryption Mode"

    Relevant Pages

    • Re: Multiple databases - best performance scenario
      ... My company has the need to manage data for multiple customers. ... Multiple small physical servers connected to SAN ... When I'm using the word database ... You might consider checking licensing costs at the oracle store ...
      (comp.databases.oracle.server)
    • Re: Rails app organization question
      ... I -really- like Rails, though. ... Have one instance of the app and somehow allow it to use different databases depending on the user's login. ... Have multiple instances of the app running on virtual servers, similar to how cPanel sets up accounts for multiple hosts -- each host has its own directory, MySQL database, and so on. ...
      (comp.lang.ruby)
    • Re: Merging Data Dynamically
      ... not mind multiple back-ends. ... But if you had told me your Sailing Clubs are all owned by ... then loop through all the tables to detach them from 1 back end database ... sudden addition of Removals5 and create a linked table for it. ...
      (comp.databases.ms-access)
    • Re: Conversion to 2007
      ... All I know Iis have multiple tables used to store data and multiple tables ... Sometime I used multiple queries to filter the information or shape reports ... Office Pro 2007 and hope it will work as well with office 2003 ... so a well-designed database may work without modification in A2007. ...
      (microsoft.public.access.tablesdbdesign)
    • Re: MySQL vrs SQLite
      ... Can multiple applications or multiple instances of the same ... But only one process can be making changes to the database at ... >>will need to implement your own data conversion though. ... declared as integer and float to the appropiate Python types. ...
      (comp.lang.python)
    Loading