|
Ask them. They sold it to you so they should solve your problems... and they can do this probably better than anyone here.
|
|
|
|
|
Hi,
I'm building an application to handle licensing some software i'm writing. I'm using the RijndaelManaged cryptography objects to encrypt an decrypt the license codes and database login info etc.
At present i have the Key and Initialisation vector values stored as byte arrays private to my cryptography class. The code works fine. The problem is that when i use a decompiler on my dll the Key value byte array is fully visible, along with my Encryption and Decryption methods, thus rendering the security useless.
My question is how do people actually store the Key value so that no one has access to it. I can't find any mention of how people actually do this, only how to use crytography once you have the key. I'm almost tempted to go back to vb6 to create my cryptography dll so i actually have some security. Does anyone else have this problem or am I missing something obvious?
Thanks
dave
|
|
|
|
|
Cryptography is mainly used to encrypt data while transmitted over an unsafe connection, e.g. the web. For this purpose, the key only have to be hidden from the web, not from users that have direct access to the computer.
blondie10 wrote: My question is how do people actually store the Key value so that no one has access to it.
You can't do that. If noone has access to the key, the program that is supposed to use the key doesn't have access either.
blondie10 wrote: I'm almost tempted to go back to vb6 to create my cryptography dll so i actually have some security.
Actually, you don't have any better security using VB6. You only think that you do, as you can't read the compiled code. Be assured that the people cracking codes do have tools/knowledge to do that.
---
b { font-weight: normal; }
|
|
|
|
|
My system is to do with licensing windows desktop based applications so other users will have direct access to the computer.
My system will have to receive and store a license code specifying which applications can be run and for how long. This obviously needs to be encrypted so the user can't change to full access forever.
Looking into public / private key pairs seems similarily problematic. The Private Key values can be stored in Key Containers but the user can get the name of the container and open it to get the key values.
If you are saying that there is no way to secure the Key value used to perform the encryption/decryption then how is any system secure.
Surely there is a way to solve this or we'd all be hacking everyone else's code rather than writing our own?
|
|
|
|
|
blondie10 wrote: Looking into public / private key pairs seems similarily problematic
Actually, it's not.
Why would you ship a private key to the public??? It would be ludicrous to do so, as you're helping the community to defeat your own key.
In the symetric system, you ship ONLY the public key with the data so the user (application actually) has the only key that can decrypt the license.
Your problem really isn't protecting the keys, it's protecting the license code. When you boil it all down, it comes to a single IF statement as to whether the app is going to run or not. Whoever wants to break your license code really won't care about the key! Their goal will usually be finding the correct path through the license code and doing a little bit of re-wiring to bypass it. This is usually much easier than trying to pry out the key.
blondie10 wrote: If you are saying that there is no way to secure the Key value used to perform the encryption/decryption then how is any system secure.
You're making the mother of all f-ups! You're assuming that any system IS secure. There's no such thing. There is ALWAYS someone who can bust your security wide open!
blondie10 wrote: Surely there is a way to solve this
Copy protection has been the pipe dream for, what, 30 years now?
blondie10 wrote: or we'd all be hacking everyone else's code rather than writing our own?
That depends on the skill level of the person in question and in what areas. Is it easier for any one person to crack the code or write a similar app from scratch?
Dave Kreskowiak
Microsoft MVP - Visual Basic
|
|
|
|
|
mmm, Dave K I think you're somewhat missing the point. Also Public / Private cryptography is asymmetric not symmetric, but who cares you're the mvp after all, though from a quick check on Microsoft's MVP web site your not listed, but hey we all need a buzz to get us through the day.
perhaps i'll rephrase the question to make it more understandable, apologies to anyone else reading this.
Firstly apologies also for the length of this, buy hey it's a big subject.
Now as i understand the public / private system, and please feel free to constructively correct me if i'm wrong (abuse and diatribes are rarely helpful), using the RSACryptoServiceProvider I have a private key with which i encrypt a license number. The user recieves the encrypted number and the local licensing application decodes the passed license value using the public key. The license app then does as required with the decrypted value. If I also use a Digital Signiture, or Hash of the message, i know that i encrypted the value originally and that it hasn't been edited by a third party so all is well.
I don't understand about sending data in reverse, does the remote system use the public key to encrypt the message and my system then uses the private key to decrypt it? If this is so does'nt this mean any user can send me a message as the public key is, well, public?
With regards to storing sensitive information such as Database login details, the encryption is done locally to the user. In this situation i guess i use a form of symmetric cryptography such as the RijndaelManaged cryptography objects i mentioned originally. This still leaves me with the same issue, that anyone with a simple decompiler can view the private key and the cryptography coding methods, as they're held locally to the user, so anyone can cut and paste them to a new project and decrypt the data.
This all seems to easy and that i must be missing something to do with symmetric cryptography, again no more replies on 'all code can be cracked with the right tools bla bla bla'. With the level of encrytion and ease of cracking shown on my own very basic and simple tests there seems to be no point on even performing encryption unless the user has no technological knowledge whatsoever.
A reply on another forum has suggested deriving the key from another source, but if my code can be viewed with a decompiler then surely the source and how the derivation is performed can also noted and duplicated.
The security in my system is not intended to hold up against serious hackers with days or weeks on their hands and the latest tools and techniques, but it should at least survive simple viewing with an online decompiler, symmetric cryptography seems to fail even at this level.
Now perhaps the only answer to the problem at this level of security would be to objfuscate the code. If this is so, do lots of people do this and what are good products to use?
thanks
dave
|
|
|
|
|
blondie10 wrote: Now perhaps the only answer to the problem at this level of security would be to objfuscate the code
It is Obfuscate, but who cares you're the friendliest person after all.
|
|
|
|
|
blondie10 wrote: but who cares you're the mvp after all, though from a quick check on Microsoft's MVP web site your not listed,
That's because I never wrote the thing and enabled it for public view.
blondie10 wrote: Also Public / Private cryptography is asymmetric not symmetric,
Sorry, I was thinking 'asymmetric' and typed 'symmetric'.
blondie10 wrote: I don't understand about sending data in reverse, does the remote system use the public key to encrypt the message and my system then uses the private key to decrypt it? If this is so does'nt this mean any user can send me a message as the public key is, well, public?
Yes, to both questions. The only difference between Public and Private keys is the arbitrary choice of which one you give out to the public.
blondie10 wrote: Now perhaps the only answer to the problem at this level of security would be to objfuscate the code.
Obfuscationis about the best choice you have that doesn't cost $,$$$.
Dave Kreskowiak
Microsoft MVP - Visual Basic
|
|
|
|
|
suppose i have one MDi form and two child form and there is two method called test1() and test2()
in form1 and form2 and there is two buttons in a toolbar attached with mdi for and when button 1
will be pressed then test1() method of active child will be fired.so how could i call a method of
active child form from mdi form.pls help me with sample code
tbhattacharjee
|
|
|
|
|
Dim frm as object
for each frm in me.mdichild ' or mdiChildren not sure while writing in here
if frm.text="Form1" then
' test1 should be public inside form
frm.test1()
exit for
end if
next
|
|
|
|
|
Hi
You could try this:
In the ToolBar's Button_Click Event write the following,
Dim frm as form
For Each frm in Me.Forms
if frm.Name="Form1" then
call form1.test1
elseif frm.Name="Form2" then
call form2.test2
endif
Next frm
hth
Chandra
|
|
|
|
|
Hi, How can i play DVD in vb.net?
|
|
|
|
|
|
I think there is a COM component called MSDVDAdm Call
That might work.
-- modified at 14:38 Friday 28th July, 2006
|
|
|
|
|
Hello,
Im encountering a deadlock when i debug certain part of a large windows form application when the code interacts with the clipboard.
i've made a small example to reproduce the problem
Public Class Form1
Private Sub btn_SaveToClipboard_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles SaveToClipboard.Click
Dim ido As DataObject = New DataObject()
Dim file() As String = {"C:\somefile.doc", "C:\somefile.txt"}
ido.SetData(DataFormats.FileDrop, False, file)
Clipboard.SetDataObject(ido, False)
End Sub
Private Sub btn_RetrieveFromClipboard_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles RetrieveFromClipboard.Click
Dim ido As IDataObject = Clipboard.GetDataObject()
If Not ido Is Nothing Then
If Clipboard.ContainsData(DataFormats.FileDrop) Then
Dim o As Object = ido.GetData(DataFormats.FileDrop, True)
End If
End If
End Sub
End Class
if i place a breakpoint anywhere and mouseclick in the code and then start singlestepping i get the same deadlock.
I googled my way to an article that seems to suggest a solution but im not sure what the solution is:
http://blogs.msdn.com/stevejs/archive/2005/12/08/501939.aspx[^]
any help is appreciated.
|
|
|
|
|
Hi Everyone!
i have small problem in my user validation programme.I have created the component,which validate the users againts the database(SQL 2000), so i have created the validation form for that one,ther is no any error when i'm build the component,my problem is when i'm run the programme it display the error of sql data adapter in this line (dataadapter.fill(dataset) can anyone help for this pls.
Error is:An unhandled exception of type "System.Data.Oledb.OledbException" Occurred in system.data.dll.
And also i need to know is there any easy way to validate the users againts the database.if it is pls help me.Thanks
|
|
|
|
|
Hi Indunil,
You may be facing this error because of wrong sql query syntex generated.
Try to print sql query you just generated before fill. Also put your fill code in try catch block.
Hope for the best.
Puran
|
|
|
|
|
Hi All,
I have created a simple Multimedia Player for my project.But met with some problems.Hope someone can help me with this.I have my MediaPlayer1 in Form1 and the selection of songs to List1 in Form2.I have added the songs i've selected to List1 in Form2.But i have no idea how to play the songs in Form1,Multimedia Player(MediaPlayer1).Any help would be greatly appreciated.Thanks alot.
|
|
|
|
|
You are not setting the datasource of the datagrid.
DataGrid1.DataSource = SOMETHING
What is this Adodc1?
|
|
|
|
|
Hi.
I am using crystal reports 9 and vb6 and MS-ACCESS Database File.
I have connected the report to the DataEnvironment command in design mode using the report wizard.
the report is then viewed through the report viewer (automatically added after the wizard completion)
the report work fine initially.
the problem is that when the number of records are increased in the table, the report becomes very slow.(more than 60 seconds and more)
am i doing something wrong?????
what are the steps to created a report properly (also using two or more linked tables)?????
thank you
|
|
|
|
|
I'm trying to make Outlook addin that will add one button to outlook context menu---
(VB.net / C# .net (NO C++ .net))
first,
ActiveExplorerCBars = applicationObject.ActiveExplorer.CommandBars
then
cmdbar = ActiveExplorerCBars.Item("Context Menu") 'cmdbar is commandbar object "^getting error here"
control = cmdbar.Controls.Add(MsoControlType.msoControlButton)
With control
.Caption = "kedar"
.visible = true
..... other props
End With
but i'm gettin an error that the parameter "Context Menu" is incorrect @ cmdbar = Active......
"i have seen code working in vb but not in vb.net so keep that in mind and reply for vb.net"
i've refered -- http://www.outlookcode.com/codedetail.aspx?id=526
http://www.outlookcode.com/codedetail.aspx?id=314 ?
and similar codes but they'r not of any use to me,.....
I think "Context Menu" is not a valid parameter. But accordg to other resources i've cometo know that outlook has that Named menu.
I'd like if anyone can post a code to add the button to context menu.
thnx in advance
"You can do any thing you set to your mind" - theGhost_k8
|
|
|
|
|
Indunil_Bk wrote: when i'm run the programme it display the error of sql data adapter in this line (dataadapter.fill(dataset) can anyone help for this pls
I would like to help but it is too vague, what error are you getting?
I'd like to help but I am too lazy to google
|
|
|
|
|
Given that the OP deleted their post, I guess they don't really want to know any more.
|
|
|
|
|
Colin Angus Mackay wrote: Given that the OP deleted their post, I guess they don't really want to know any more.
I guess not
I'd like to help but I am too lazy to Google it for you.
|
|
|
|
|
PaulC1972 wrote: I'd like to help but I am too lazy to Google it for you.
 I love it!
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
