   Serial key generation
  Hi.Im getting close to completing my first shareware title. I will put the trail version up on my website as a free download wich can then be upgraded to the full version by buying a serial key for it also on my website. For now i dont want anything fancy. Any valid serial key will be able to unlock any copy of the game. I want the game to be able to check if a givin key is valid and i want a small key generation tool that would generate a unique key based on a seed number. So basicly i need these two methods.String generateKey(long seed){  return aKey; //where aKey is the key generated from the seed number;}public boolean isKeyValid(String key){  return true/false;}Im guessing il have to break the key up into 2 parts. and then encode the seed number into both parts. When i then check if the key is valid i just need to decode these 2 parts and check if the number i get from both is the same. This doesnt seem very hard to do but im just wondering if im going about this the right way. I would appreciate any comments/suggestions/tips.Thnx in Advance!   
  Hey EternityZA,Have you considered an online solution, as where the user logs on with an account, and is authenticated at run-time?It's much harder to break this sort of authentication than by using random numbers.That aside, it's also possible to use other parametres when generating a key, to ensure its uniqueness.A timestamp and the client name, for instance. Salting, where you for instance apply another unique sentence associated with the sender.You can bitshift, rule-out specific characters and do cross-calculations.Checksums and other things, that you can try to manipulate so bad, that it will be difficult to reverse-engineer.But not impossible, of course.This is why i suggest the first option. It's also easier to associatepayments and administrate upgrades and add-ons like this.Though, I prefer offline stuff too. I don't like having to be online whenI want to play a specific game. But consider including more stuff in the generated key.   ;  This is a technical rather than design issue, so I'm moving you to General Programming.  Good luck with your question! [smile]   ;Quote:Original post by EternityZApublic boolean isKeyValid(String key){  return true/false;}This type of code results in something like:test eax,eaxjnz ...To break such encryption, all that needs to be changed is jnz to jz (or vice versa).Note that no knowledge is required of actual algorithm used, or any deeper inspection - just a search through executable for test/j?z.;Quote:Original post by SuperVGAHave you considered an online solution, as where the user logs on with an account, and is authenticated at run-time?There's a lot of disagremeent for on-line systems. If the server goes down, what do you do with the game?Quote:Original post by AntheusTo break such encryption, all that needs to be changed is jnz to jz (or vice versa).That'd make it work when a non-valid key is entered only. A hacker would usually replace it with a JMP or NOPs (depending on the situation), then it'd work regardless of the key.Lemme put it simple: if the user gets the full content, then expect it from being cracked immediately. So, make the trial only contain the data it needs, then when registering give out the full game. This will reduce the amount of casual pirates since it's going one step further.Yes, pirating will still happen probably, but software-based DRM is always crackeable because of the way it works =P Those who pirate are unlikely to pay for it anyways (if they can't pirate it then they won't get it), so bother to make things easier to those who are willing to pay.   ;  There are plenty of options.You could assign each licence a guid as its licence key and check the licence key when the application starts using a webservice call.Or if you just want to stop regular users and you aren't that worried about security you could combine a date stamp with a pass phrase and then base 64 encode the string.   ;  Just release the demo free and the full version with a price. If someone wants to crack the protection they will. Serial keys are available in many places, even for small projects and games. You'll  have to trust your clients.   ;  This is a classic cost vs benefit situation. You really have to evaluate what the best path is.Personally, I've become a fan of the serial key unlocks the entire game idea provided the two portions are not too far apart in size. (If the trial is 100 MB and the full version is 10 GB, then yeah, separate them.) Games sell just fine regardless of how they are protected. You just have to offer some real quality.   ;  Generally speaking, if your game is any good it'll be cracked anyway. As a shareware developer you don't have the resources to create a secure game. Hell, the big-name game development companies don't have those kinds of resources. Thus I'd tend to err on the side of "basic system that keeps normal users honest, but is easy to crack". Users that refuse to buy games will still download the cracked version, just like they would if you spent several weeks/months working on a secure system. Those that will buy games will still buy them, and won't be annoyed by a game that treats them as if they're criminals. All you're gaining by adding security is selling copies to those users would wouldn't pay if they don't have to, but aren't willing to download cracked versions.That in mind, I'd recommend a simple public/private key system. The user gives you a registration name, you encrypt that with some salt on the server side (private key) and hand them their registration code. They plug their name and the code into the game, it decrypts the code (public key) and makes certain the result is their name plus the salt. If it matches, they're registered and the game content is unlocked. Simple, isn't a pain in the ass for normal users, and secure against the only kinds of people you have a hope of being secure against.   ;  To make a keygen proof license key you want to use public key cryptography.You sign your license key with your private key upon generation. Your game verifies signature using the public key and knows it can only have been generated by someone in possession of the private key. As long as your key is big enough it'll be secure.That of course doesn't prevent them modifying your code to bypass the checks, or simply purchasing the game with a dodgy credit card and posting that key online.   