🚀 go-pugleaf

In message <na.ec74224873.a70260astoneha@argonet.co.uk>
          GIJoe <astoneha@argonet.co.uk> wrote:

> 1.  Encrypt all of the files and allow for them to be decyrpted later so   
>     that none of the files can be copied.

PGP will do the trick.  Accept nothing less. :)

> 2.  Have a credit scheme so that it can only be installed once.

Never came across one on the Acorn that doesn't take less than half an
hour to get round.

Cheers,
Rob Kendrick

-- 
E28F0018 E5D02000 E232202A E4C02001 1AFFFFFB E28F0004 EF020002
EF020011 445D456E 5E435D0A 43670A42 59455849 0B5E4C45 0000002A
            http://www.kiwisoftware.demon.co.uk
10 REPEAT PRINT "Hello world!":UNTIL FALSE

Rob Kendrick <rob@kiwisoftware.demon.com.uk> writes:

> In message <na.ec74224873.a70260astoneha@argonet.co.uk>
>           GIJoe <astoneha@argonet.co.uk> wrote:

> > 2.  Have a credit scheme so that it can only be installed once.
> 
> Never came across one on the Acorn that doesn't take less than half an
> hour to get round.

under 5 minutes using a Commodore Disc Duplicator [1]

Nick

1: usually sold under the brand name "Amiga"
-- 
#!perl -wlpi[finger.liv.ac.uk]  # Black olives http://www.flirble.org/nick/
BEGIN{$_="use SocketYIN;sockeXPZSOCK_STREAM,~proto'tcp'and\$|=connecXpack'S
na4x8',AZ79,\$;=~host qq$^Ior die\$!;print'/w nickc\r'YOUT;print\$^I";s;X;t
STDIN,;g;s\Y\;select STD\g;s$Z$F_INET,$g;s{~(\w*)}}get$1byname}g;eval||die}

In article <na.ec74224873.a70260astoneha@argonet.co.uk>,
 GIJoe <astoneha@argonet.co.uk> wrote:
> I'm currently working on a program that I am hoping to release as
> comercial software.  The main part of the program is finished (its at
> version 0.05 atm).

[snip intentions to encrypt program]

> 2.  Have a credit scheme so that it can only be installed once.

Don't even think about it. What happens if the HD fails? Why should the
software license restrict the user from reformatting his/her hard disc?

There's not much point, as there's not a lot you can do to stop the user
simply taking a copy of the installed version.

Char;ie

-- 
The address in the headers is a temporary email address. To mail me use
charlie.baylis @ altavista.net  (remove spaces)

GIJoe <astoneha@argonet.co.uk> wrote:

> 1.  Encrypt all of the files and allow for them to be decyrpted later so
>     that none of the files can be copied.

This is a misconception.  Encrypting data doesn't stop you from copying
it; it just stops you from being able to interpret it.

Besides, in the context of an installer, all you can do is obscure the
files: the key has to be provided to the customer anyway, at which point
any copies become usable too.  Real cryptography won't buy you anything
here.

> 2.  Have a credit scheme so that it can only be installed once.

Unworkable.  Also, this may violate the customer's fair use rights.


This is technically pointless, and it's all on morally dodgy ground
anyway.  Stay well clear.

-- [mdw]

Rob Kendrick <rob@kiwisoftware.demon.com.uk> wrote:

> PGP will do the trick.  Accept nothing less. :)

 This sounds somewhat contrived; why would you want to use a
specific implementation of a cipher?  There are are a variety
of acceptable block and stream ciphers that could be used
for this purpose (IDEA, Blowfish, Twofish, etc.), but all of
them are flawed by the simple problem that the `key' required
to unlock the software can be spread by mouth.

-- 
Chris <chris@fluff.org>                         ( http://www.fluff.org/chris )

Chris rutter wrote
>Rob Kendrick <rob@kiwisoftware.demon.com.uk> wrote:
>
> > PGP will do the trick.  Accept nothing less. :)
>
> This sounds somewhat contrived; why would you want to use a
> specific implementation of a cipher?  There are are a variety
> of acceptable block and stream ciphers that could be used
> for this purpose (IDEA, Blowfish, Twofish, etc.), but all of
Erm, PGP uses IDEA. Blowfish is partially susceptable to differential
cryptanalysis (at reduced rounds). IDEA is probably the best bet, though

TEA (tiny encryption algorithm) has been shown to resist differntial
cryptanalysis
quite well.
> them are flawed by the simple problem that the `key' required
> to unlock the software can be spread by mouth.
The key is always the weakest link, why spend years brute forcing
the answer on computers, when you can threaten the rabbits of the
key owner and get it in 5 minutes :)

Peter
In a sadistic mood

Peter Howkins <p.j.howkins@lboro.ac.uk> wrote:

> Erm, PGP uses IDEA. Blowfish is partially susceptable to differential
> cryptanalysis (at reduced rounds). IDEA is probably the best bet,
> though

There have been no results at all against the full Blowfish cipher[1].  The
only result I'm aware of is that a class of `weak' keys can be detected
in reduced-round variants.  The weak keys can be tested for and rejected
if you're worried about them: they're not very numerous.

Then again, Daemen found a class of weak IDEA keys, and Borst, Knudsen
and Rijmen have demonstrated truncated differential and differential-
linear attacks against reduced-round variants of IDEA (see `Two attacks
on reduced IDEA'[2]).

I'd rather trust Blowfish than IDEA right now.


[1] Results from Lars Knudsen's `block cipher lounge':
    http://www.ii.uib.no/~larsr/bc.html.

[2] An extended abstract of this paper may be found at
    ftp://ftp.esat.kuleuven.ac.be/pub/COSIC/rijmen/idea.ps.gz.

-- [mdw]

In message <35D9A514.7C57B5E@lboro.ac.uk>
          Peter Howkins <p.j.howkins@lboro.ac.uk> wrote:

> Erm, PGP uses IDEA. Blowfish is partially susceptable to differential
> cryptanalysis (at reduced rounds). IDEA is probably the best bet, though

From what I understand, only if you ask it to, otherwise it uses RSA.

Cheers,
Rob Kendrick

-- 
E28F0018 E5D02000 E232202A E4C02001 1AFFFFFB E28F0004 EF020002
EF020011 445D456E 5E435D0A 43670A42 59455849 0B5E4C45 0000002A
            http://www.kiwisoftware.demon.co.uk
Remove NOSPAM to email personally.
10 REPEAT PRINT "Hello world!":UNTIL FALSE

Rob Kendrick wrote
>I wrote
> > Erm, PGP uses IDEA. Blowfish is partially susceptable to
differential
> > cryptanalysis (at reduced rounds). IDEA is probably the best bet,
though
>
> From what I understand, only if you ask it to, otherwise it uses RSA.
You are right PGP does use RSA, but that is for its key management. RSA
is
rock hard cipher, that PGP uses to encrypt keys for IDEA, then the rest
of the
message is done in IDEA (I think, never having used pgp myself, and
going by
this magazine article)
>
> Cheers
no prob

Peter
--
p.j.howkins@lboro.ac.uk

Mark Wooding wrote:

> Peter Howkins <p.j.howkins@lboro.ac.uk> wrote:
>
> > Erm, PGP uses IDEA. Blowfish is partially susceptable to differential
> > cryptanalysis (at reduced rounds). IDEA is probably the best bet,
> > though
>
> There have been no results at all against the full Blowfish cipher[1].  The
> only result I'm aware of is that a class of `weak' keys can be detected
> in reduced-round variants.  The weak keys can be tested for and rejected
> if you're worried about them: they're not very numerous.
>
> Then again, Daemen found a class of weak IDEA keys, and Borst, Knudsen
> and Rijmen have demonstrated truncated differential and differential-
> linear attacks against reduced-round variants of IDEA (see `Two attacks
> on reduced IDEA'[2]).
>
> I'd rather trust Blowfish than IDEA right now.
>

You could well be right, I was half remembering something I read in Schnier's
book'applied cryptography' where he critiques his own cipher, by saying that it
had a
problem at reduced rounds. I thought it diff-cryptanalysis though it could well
be weak
keys.

> [1] Results from Lars Knudsen's `block cipher lounge':
>     http://www.ii.uib.no/~larsr/bc.html.
>
> [2] An extended abstract of this paper may be found at
>     ftp://ftp.esat.kuleuven.ac.be/pub/COSIC/rijmen/idea.ps.gz.
>

I shall have to look at these when I get a chance.

Peter
--
p.j.howkins@lboro.ac.uk

Peter Howkins wrote:
> The key is always the weakest link, why spend years brute forcing
> the answer on computers, when you can threaten the rabbits of the
> key owner and get it in 5 minutes :)

Ah, someone after my own heart.
HUMINT wins over SIGINT every time!

---druck

druck <druck@rta.ricardo.com> wrote:

> HUMINT wins over SIGINT every time!

I find SIGQUIT and SIGKILL more effective than SIGINT too.

-- [mdw]

In message <na.ec74224873.a70260astoneha@argonet.co.uk>
          GIJoe <astoneha@argonet.co.uk> wrote:

> Hiya
> 
> I'm currently working on a program that I am hoping to release as comercial
> software.  The main part of the program is finished (its at version 0.05
> atm).  The program can have other programs added to it that adapt the output
> of the original program I've been calling these add-on apps and have written
> 2 so far.  Now what I am looking for is 2 add-on apps or one that can do
> both of the following:
> 
> 1.  Encrypt all of the files and allow for them to be decyrpted later so    
>     that none of the files can be copied.
> 
> 2.  Have a credit scheme so that it can only be installed once.
> 
> The program I am working on is a program that makes installers for other
> peoples programs thus it is a high end solution to speed program development
> and allows you to install mainly into the !Boot structure the files that are
> needed but I have extended the idea through an add-on app that creates a
> save box interface onto the installer.
> 
> The encryption and credit scheme program(s) are a little above me as I have
> no idea how to encrypt files.  There may be some money given to the author
> of such an add-on app depending on whether the entire program becomes
> commercial or not.  I can give full details of the add-on apps format by
> e-mail so if anyone is interested in taking this on then please e-mail me
> ASAP. 
> 
> TIA
> 
> Allan :-)
> 

I don't think one can write a one-shot installation scheme that many of the
people who frequent this newsgroup couldn't hack. One can write such a
a scheme that will work for naive users and also one that will resist
some, but not all, means of copying the installation disc prior to
installation. So how much security do you want to claim for this scheme?
You'll find that any kind of copy-protection/security/privacy claim that you
make for a software product makes a disappointing selling point if your
claim is anything less than __absolute__. (Irrational, I know).

Bear in mind also that a one-shot installation scheme really also has to
embrace some method of __deinstallation__ that gets the user back to
pristine, uninstalled distribution media, but at the same time doesn't
defeat the purpose of the scheme. You cannot commit a user to installing
the software, right first time, on a single machine, for ever, unless maybe
you are only targeting games. If you do, all of your few customers will
quickly learn to hate you. The need for a sufficiently secure method of
deinstallation complicates matters considerably.

'Quota' systems, i.e. N legal installations from the original media, have
the same sort of security status and are not intrinsically harder to
program but are N times more unwieldy from a system administrator's point
of view.

As to encryption: What exactly is supposed to be achieved by the encryption
system? How do you think of it as working to protect anybody's investment
in the software?

   
 
-- 
Mike Kinghan,
Turing Tools, 20 Don Bosco Close, Temple Cowley, Oxford OX4 2LD
Tel. 01865 438231
`The truth is rarely pure and never simple' - Oscar Wilde
`Guinness is rarely pure and never ample' - Ned Kinghan