CODEWITHSUNDEEP
c#encryptionc#-4.0
bugfixr
bugfixr

Reputation: 8077

Encrypt from server, decrypt on client (but not encrypt on client)?

Is there a way that my server can provide an encrypted string that can be decrypted on the client, but NOT re-encrypted on the client? I know this seems kind of backwards... here's what my need is.

I have a software key that needs to be activated against our remote server. The server needs to provide something back to the client that says "You are active" and contain info such as a date that it's valid until, how many licenses, etc. However, I need to prevent it from being easily tampered with to increase license count or the dates (i.e, re-encrypt the value with a new date using a key found in the de-compiled binary or w/e).

Is such a thing possible using public/private keys? Or perhaps hashes?

EDIT

Alternatively, can the server provide a hash that the client can validate is really from the server without giving the client the ability to spoof or generate a hash on it's own?

Thanks in advance.

Upvotes: 0

Views: 2278

Answers (2)

KeithS
KeithS

Reputation: 71563

Sure. Use an asymmetric-key algorithm like RSA. Both keys are required to go from cleartext to cleartext; one will encrypt, the other will decrypt. You cannot use the same key you encrypted with to decrypt, and vice-versa. So, the client could not get ciphertext, decrypt it, then use any of the information it has to come up with the same ciphertext.

HOWEVER, asymmetric-key algorithms do not differentiate between the encryption and decryption keys until one is used to encrypt. They only require that the other key is used to decrypt a message encrypted by the first. So, theoretically, your client could "re-encrypt" a message using its "decryption" key that would be decrypt-able by the server using its "encryption key". I don't know of an algorithm that would disallow this; you'd simply have to build it into your communication library by omitting any way to use the decryption key for anything but decrypting.

Upvotes: 1

Paul Kearney - pk
Paul Kearney - pk

Reputation: 5533

Public/private key encryption should do what you need. Hashes are one way functions; a good hash function will make it impossible to retrieve the original value.

In this case, the server has a public/private key pair and the client has a public/private key pair. The server's public key is embedded into the client, and the server has the client's public key as well. The server can now encrypt your payload using it's private key and the client's public key. When the client wants to decrypt the payload, it uses it's private key and the server's public key. The client cannot re-encrypt the data without access to the server's private key.

http://en.wikipedia.org/wiki/Public-key_cryptography - for an explanation of how it all works

http://msdn.microsoft.com/en-us/library/e970bs09.aspx - as a starting point for .Net classes to make it easier

Upvotes: 1

Related Questions