问题描述
这是延续到我的previous的问题在这里：
This is continuation to my previous question here:
比方说，我已经生成公钥/私钥对，但我想保存注册的应用程序本身的私钥 - 通过生成的.c code只包含数据（公钥和私钥部分）例如：
Let's say I have generated private / public key pair, but I want to save private key within registered application itself - for example by generating .c code which contains only data (public and private key parts).
当然，这是有风险的解决方案 - 因为如果黑客应用程序提取私钥 - 他可以自己创建许可证
Of course it's risky solution - since if hacker extracts private key from application - he can create licenses by himself.
但是，这是穷人的解决方案，所以我想一切是在一个应用程序 - 私钥和公钥 - 所以报名表是同样的序列号生成对话框
But this is "poor man solution", so I want everything to be in one application - private and public keys - so registration form would be also serial number generation dialog.
所以，我希望把里面的应用程序的私有密钥，但也有一些密码，只有我知道，以保护它。
So I want to place private key inside application, but to protect it with some password, which only I know about.
所以，通过输入序列号 - 在第一遍我们试图匹配特定的硬件（验证签名），但如果一个人不成功，我们尝试检查，如果最终用户是管理员（或序列号生成人）。
So by entering serial number - in first pass we try to match against particular hardware (verify signature), but if that one does not succeeds, we try to check if end-user is "administrator" (or serial number generation person).
什么是最好的双向加密算法，这将使用密码作为输入，将能够容忍暴力攻击？
What would be best two-way encrypting algorithm , which will use password as an input and would be tolerant to brute force attacks ?
我猜管理员密码应该是足够可靠，不要轻易被猜到（在任何已知的蛮力破解字典中未列出）。
I guess "administrator password" should be reliable enough, not to be easily guessable (not listed in any well known brute-force hack dictionaries).
此外，它会是很好的加密形式存储至少密码注册表/或。也许是有道理的密码=== SHA-1散列===> 20字节的哈希 - 存储在注册表（管理员密码），然后使用散列加密私钥
Also it would be good to store password in registry / or at least in encrypted form. May be makes sense to password === sha-1 hash ===> 20 bytes hash - store it in registry ("administrator password"), and then to use hash to encrypt private key.
同样的问题在previous的问题 -
作为一个基地我会preFER使用普通C或C ++（不是C＃），preferably的Windows / wincrypt.h或任何现有普通的C源代码code（preferably不是很大，3-第三方库）。
Same issue as in previous question - As a base I would prefer to use plain C or C++ (not C#), preferably Windows / wincrypt.h or any existing plain C source code (Preferably not huge 3-rd party libraries).
推荐答案
的注意事项：的
- 这是不太回答有关给定的加密算法的直接问题，但更多的关于您的总体目标，根据你的两个发布的问题和答案和意见。
- 当我按照软件的安全问题一般，我的不的专家，所以采取什么我说此相应。
- This is less of an answer to the direct question about a given encryption algorithm, but more about your overall goal, based upon your two posted questions and answers and comments.
- While I follow software security issues generally, I'm not an expert, so take anything I say herein accordingly.
您正在试图保护你的软件。也就是说，你在找什么，是落实发牌制度的一种方式。
You're trying to protect your software. That is, what you're looking for is a way to implement a licensing scheme.
您需要什么[和希望有]，但没有发布是该功能/设计规范。两个单向加密只是其中的一部分。
What you need [and hopefully have], but did not post is a functional/design specification for this. The two way encryption is but a part of this.
你是不是需要这样的第一人。已经有方案来做到这一点。我建议你使用现有的解决方案。有可能是一个公开/免费的开源版本。
You aren't the first person to need this. There are already schemes to do this. I'd recommend using an existing solution. There is probably a public/free open source version.
您谈到的电子邮件和登记表和剪切和粘贴，但其工作原理没有详细说明。你们也没有提到这一点，如何与您的应用程序进行交互。你使用Web浏览器注册或安装了该应用present注册对话框？
You talked about email and registration form and cut-and-paste but didn't detail how that works. Nor did you mention how this interacts with your application. Do you register with a web browser or have the app present a registration dialog?
我猜测，你有一个用户输入电子邮件地址变成一种形式。然后，您的服务器将发回一封电子邮件，其中一些特殊的code [例如这是有效的15分钟]，该用户必须输入完成注册证明的电子邮件是有效的，与系统的身份信息一起
I'm guessing that you have a user enter an email address into a form. Then, your server will send back an email with some special code [e.g. that is valid for 15 minutes] that the user must enter to complete registration to prove the email is valid, along with the system identity information.
您提到的剪切和粘贴的限制因素。但是，海事组织，它的不是的真如你可以把钥匙在MIME EN codeD附件，并让用户将它保存到一个文件中。然后，将报名表可以上传这个文件。即使是一个漫长的值是（例如10行72字符/行）将仍适合剪贴板中。
You mentioned that the cut-and-paste is the limiting factor. But, IMO, it isn't really as you could put the key in a MIME encoded attachment and have the user save it to a file. The registration form could then upload this file. Even a lengthy value that is (e.g. 10 lines of 72 chars / line) will still fit inside a clipboard.
您收集[希望]关于客户端系统的唯一识别信息。现在的CPU序列号为0的最后奔腾III处理器[除非在BIOS中启用。但是，其他 CPUID 部分可以提供一些独特性。以太网MAC地址的是的独特的，但很多网卡允许它在软件中进行更改。磁盘序列号是不是一个好的选择[IMO]由于磁盘具有最高的故障率和需要更换随着时间的推移。
You gather [hopefully] unique identifying information about the client system. The CPU serial number is now 0 on most post pentium-III processors [unless enabled in the BIOS]. But, other CPUID parts may provide some uniqueness. The Ethernet MAC address is unique, but many NICs allow it to be changed in software. A disk serial number isn't a good choice [IMO] because disks have the highest failure rate and need to be replaced over time.
但是，让我们假设你可以从上述来源[也许有些人]收集足够的信息来获得一个系统ID。你可以像使用用户名其他的东西并置这一点，等等。你可以通过像SHA1单向散列运行这个[或任何]如果你选择。所以，现在，你已经有了一个系统标识。保存在某个地方（例如文件或注册表）
But, let's assume you can gather enough information from the above sources [and maybe some others] to get a "system ID". You can concatenate this with other stuff like username, etc. You can run this through a one way hash like sha1 [or whatever] if you choose. So, now, you've got an "system identity". Save that somewhere (e.g. file or registry)
但是，存储的中的应用[或客户端系统上的任何地方]私人的关键是一个非首发，海事组织。你只在生成阶段需要这个。
But, storing the private key in the app [or anywhere on the client system] is a non-starter, IMO. You only need this during the generation phase.
所以，有注册过程发送系统的身份，你控制一个专用服务器（如亚马逊EC2）。服务器加密/迹象[使用公钥/私钥加密（如RSA）]系统的身份，并发送回公钥和符号结果。这些获取存储。
So, have the registration process send the system identity to a private server that you control (e.g. Amazon EC2). The server encrypts/signs [using public/private key crypto like RSA] the system identity and sends back the public key and the "signed result". These get stored.
有任何应用程序的验证，以regather系统身份的信息，与它和公共密钥应用的算法。它应与符号的结果。
The verification for any app is to regather the system identity information, apply the algorithm with it and the public key. It should match the signed result.
这消除了需要存储与应用程序的私有密钥，保持与使用RC4 [或当量]密码加密。这消除了复杂性，仅仅起到了削弱摆在首位你的保护。
This eliminates the need to store the private key with the app, keep it encrypted with a password that uses RC4 [or equiv]. This eliminates complexity that just served to weaken your protection in the first place.
我对系统管理员或串证代人有点困惑。如果这不是你[或您的服务器]，那么就意味着你要放弃了OEM合同和本地管理员可以为系统这种控制下，一个给定的子集许可证。所以，你需要[即被发送到你的服务器]，以允许生成多个许可证的OEM密钥。
I'm a bit confused about the "system administrator" or "serial license generation person". If that's not you [or your server], then it implies you're going to give out OEM contracts and the local admin can generate licenses for a given subset of systems under this control. So, you'll need an OEM key [that gets sent to your server] to allow multiple licenses to be generated.
现在，这个坏消息。
的任何的软件授权方案是[容易]易碎。在应用中，无论多么复杂[或简单]验证算法，它归结为一个[或多个] /无故障测试。也就是说，这样的：
Any software licensing scheme is [easily] breakable. In the app, no matter how complex [or simple] the verification algorithm is, it boils down to a [or multiple] go/nogo tests. That is, something like:
#include <stdlib.h>
int user_authorized(void);
void run_program();
int
main(void)
{
if (! user_authorized())
abort();
run_program();
return 0;
}
这语句：
.globl main
main:
subq $8, %rsp
call user_authorized
testl %eax, %eax
je .L5 # change this to a nop
xorl %eax, %eax
call run_program
xorl %eax, %eax
addq $8, %rsp
ret
.L5:
call abort
注意 JE .L5 中止程序。如果程序修补改变这一指令 NOP ，许可证测试通行证，不管是什么 user_authorized 做
Notice the je .L5 to abort the program. If the program is patched to change this instruction to nop, the license test "passes", regardless of what user_authorized does.
这可以重复尽可能多的安全检查的程序了。
This can be repeated for as many security checks as the program has.
安全是一个相对的概念。一个$ 50个应用程序并不需要尽可能多的保护为一体，售价为$ 500,000（如一些CAD / Xilinx公司的CAE程序）。
Security is a relative term. A $50 app doesn't need as much protection as one that sells for $500,000 (e.g. some CAD/CAE programs from Xilinx).
乘坐从微软的剧本叶。他们present一个牌对话框，你必须接受（即收缩包装）。我们必须接受该协议。它禁止逆向工程等，这为您提供了法律保护。这个咨询律师。
Take a leaf from Microsoft's playbook. They present a "licensing" dialog that you must accept (i.e. "shrink wrap"). One must accept the agreement. It prohibits reverse engineering, etc. This gives you legal cover. Consult an attorney on this.
这是除了，不管软件方案您最终决定。
This is, in addition to, whatever software scheme you ultimately decide on.
这篇关于可怜的人序列号生成方案，第2部分的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！