title: Secure licensing system for iOS app
body: <p>A few similar questions have been asked before on SO, but I've yet to find one that pinpoints exactly what I'm trying to do.</p>
  
  <p>I have an iOS app that I'm trying to build a reasonably secure licensing system for.</p>
  
  <p>There will be a (PHP-based) central server with a front-end where people can buy licenses to use the software, and a back-end database which stores all the licensing information.</p>
  
  <p>From the iOS app, users will be able to input a license key which then gets sent to the server, checked against the database, and the server will then respond with information pertaining to that license (e.g. expiry date) -- or will respond with an "authentication failed" message if no such license exists.</p>
  
  <p>The question is how best to implement this, and what technologies should be deployed in order to make this work.</p>
  
  <p>My first instinct would be to do public-key RSA encryption so that the server can sign all the license keys and the app can verify them. But is this overkill?</p>
  
  <p>Would using SSL at the socket layer be sufficient to ensure that the license key is legitimate? (or could malicious users create spoof DNS records and pretend to be my license server and always send valid licenses?)</p>
  
  <p>I'm trying to find a fairly neat and simple solution which also plays nicely between Objective-C/iOS and PHP.</p>