35

What methods / libraries / tools would people suggest for generating license keys (those lovely AAAAA-AAAAA-AAAAA-AAAAA-AAAAA things you put in when you register software)?

Any gotchas to look out for when implementing them?

(At the moment I'm interested in this as a general thing rather than language specific so just state what language you're using if your solution is language specific).

Jon Hopkins
  • 22,764

3 Answers3

23

It's about the same as when storing passwords. You should have a unique secret key known only to the generator and your program. Use this key to manipulate the details (user name, password, organization, etc) and then hash it. You can then do something trivial transfer encoding in Base32 on the hash or simply move it to a hex string if you don't care about a format.

Any gotchas to look out for when implementing them?

Keep secrets secret and separate. Make your implementation improvable. If someone breaks it can you easily change the implementation? One common implementation on desktop applications is to use a remote server to validate the license. This removes the possibility that someone could reverse engineer a hash or the algorithm by inspecting the application itself.

Josh K
  • 23,029
  • 12
    BASE32 to encode is the standard. It allows easy human user entry ;) (Base32: selection of letters and numbers that are very different. For example, 0 and O are not in the sequence) –  Dec 08 '10 at 13:59
  • 1
    @Pierre: I didn't know that, good information! – Josh K Dec 08 '10 at 14:14
10

This same question was asked on SO and the accepted answer is pretty good. The general gist is:

  • Take the user's name
  • Concatentate the users name and the secret key and hash with (for example) SHA1
  • Unpack the SHA1 hash as an alphanumeric string. This is the individual user's "Product Key"
  • Within the program, do the same hash, and compare with the product key. If equal, OK.
Community
  • 1
Walter
  • 16,146
1

My preferred method is to generate 10,000 random license strings, SHA1 (or MD5) hash them or HMAC them, and include all or part of the SHA1/MD5 hash in the executable itself. When a license string is entered, you simply use obfuscated code to generate the hash of the string and compare it to the ones in the list. If it matches, it's a valid license. If you run low on licenses, release a new version with more strings.

Using just the first 96-bits of the SHA1 hash is adequate. So 10,000 licenses would take under 120KB. Algorithmic generation of keys or creation of a key generator would be impossible. The only vulnerability you'd have to worry about is reverse engineering or bypassing. (Or someone distributing their valid key.)

David Schwartz
  • 4,696
  • 22
  • 26