Public/Private Key Based Licensing

Question

I want to add licensing to my Delphi application.

This is the flow i have in mind :-

1. User sees the licensing screen when the program is run and is not licensed/activated.

2. He clicks export, which would export a file containing hardware information of user's machine. This file would be encrypted using a public key (A). (Private key for this would be available with the web application)

3. User will upload this file to my web app which in turn will allow the user to download his license file. License file will be based on User's hardware info (MAC ID, CPU Serial, etc). This file will be encrypted using another public key (B). (Private key of it would be available with the Delphi application)

4. User will import this license file to his Delphi application to activate it.

The Import/Export step has been added just in case user does not have an internet connection on which he wants to use this application

I am exploring TurboPower LockBox 3 for this purpose.

I need some help in deciding if my approach is right.

Should i be using symmetrical encryption instead for this scenario ?

I don't want the complete thing to be too complex. I am ok with a mediocre level of security.

Please guide.

Thanks !

Answer 1

You should use asymmetric keys. Don forget the keys need to be in your program in order to be used. Anyone with a hex editor could potentially open your exe file and see your key.

Also, the key file should be encrypted with a private key and not a public key. This way, only you can generate a key.

I have something similar done for my apps. It took me about 2 days to implement.