Is a RSA-signature of some identifying data a safe way to implement a license key? I have this idea of implementing a license key:


After the user downloads the program, he connects to a website and sends his Windows product ID.
The website, then, sends this back to him with a signature using a private RSA key. 
The program, then, checks, using a public key, whether it is really signed by the private key, and stores this message it got.


Now, every time the program starts, it retrieves this message, and checks it in the way mentioned in 3., comparing that with the windows product ID retrieved from the operating system.

This is done using 1024 bit numbers.
I can't encode anything with the private key using what the computer language (C#) offers. (I don't want to implement my own algorithm – I don't know enough about encryption.)

Is the Windows product key long enough for this? It's something like 12345-abc-1234567-12345. (Get it by right-clicking on “my-computer”, and clicking “properties”.)

I apologize for my non-cryptographer way of asking. Here are the questions:

a) Is encrypting a small number by a large key safe?

b) Is signing a message (as opposed to encrypting it) safe?
That is not a bad method of doing a license key; an attacker would certainly be unable to generate a signature that would validate with his computer's window product key.

On the other hand, this approach may be overkill. The easiest way to attack this system would be to modify the program to skip (or ignore) the signature validation; hackers have both the experience and the tooling to do this fairly easily.  I don't believe that there are any easily implemented license key approaches that make that attack more difficult; however, there are certainly other approaches that would be easier to implement.

Since you asked for cryptographical advice, here is some:


If you do use this approach, you might as well make sure you get the details correct; you use a known-good padding scheme (say one of the ones listed in PKCS #1).
You ask whether the window product key is long enough.  The answer is "Yes, it is".  Actually, the length of what you sign is not important to the security of the signature method; it just needs to be long enough to be unique.