Programming Change

I don't have the algorithm.  I need a random one created that follows some formula, so as to authenticate any user that might need to unlock the software.

Thanks!

What you are asking for is quite a task ... One relatively simple way of doing it will be ...

Take some constant information like cutomer name, product version etc. and form a string. Calculate MD5 hash of this string.

MD5 + Serial = constant number

This is fast and easily reversible but is not too secure either.

Yet another way will be to define fields in your serial, say first 4 digits will be a number divisible by 13 next 4 digits will be a prime number and so on so forth ... you can then convert them to base 36 or any other number of characters ...

As you can see, the security in either case depends on how well you can keep a secret.

If you want, you can use some "randomize" algorithm to do this.

-ssnkumar

ssnkumar,

>If you want, you can use some "randomize" algorithm to do this.
The issue with randomize algorith is how do you verify a serial if it is correct or not?

cheers!
sunnycoder

Use some seed such as mail id (it has to be converted to an integer using another algorithm).
This is just an alternative approach that I thought:-)

-ssnkumar

seeding is fine ... Assume that a copy of your program is with a customer who enters a serial number. Now your program needs to decide if the serial number is correct or not. So you will have to seed the random number generator and regenerate the same sequence of random numbers but
 - uptil what point? It might be a thousand or million iterations before you get the serial.
 - how do you ensure that it does not accept any other random number as serial? A random number generator is expected to generate every value after sufficient iterations
 - How do you make sure that it does not generate same key twice - you need unique random numbers and not just random numbers

There might be more but that was all I could think of at the moment.

Yes, you are right Sunnycoder!

-ssnkumar

mj9821,

Is it OK to impose a restriction that you need internet connection to register?

If yes, then we can have far more reliable method as

Take some constant information like customer name, product version etc. and form a string. Calculate MD5 hash of this string. Append current time to this string.

MD5_time + Serial = constant number

Or even

MD5_time

While registering the time component will be the time at which the serial was generated by you (time of purchase) and give customer name etc, you should be able to retrieve time from your database to verify the serial.

You can do some reversible bitwise operations on final string to make it more secure.

Cheers!
sunnycoder

some reversible bitwise operations on final string to make it more secure than MD5?

If the constant information can be guessed, the MD5 hash can be duplicated.
You should probably include a secret key in the constant information.

No, just harder to guess ... MD5 is still there

>Most every validation routine eventually ends up at a conditional jump instruction-- all the cracker has to do is find that
>instruction and put a 90h (NOP) over it and the app is cracked.

But note that serial number generators are looked more highly upon than file modifications.

Anyhow, anything except crippleware can be cracked. And with crippleware, it's just time before some registered user put the full version on one of the p2p networks.