Getting the MAC address and using that for licensing

[Jason Richard]

Hi all,

I'm diving into uncharted territory, and could use a compass.

I have an application that I've written, and now it needs to be licensed. What we want to do, is to deploy the jar onto a computer (either Solaris or windows), and compare it against a license file that we've generated and provided. The license file (encrypted) is keyed off the mac address, as to only let the application be on computers they've registered with. Assuming the mac address matches up, I want to then check the user name against the same file (there will be specific allowed named users, that they provide before we generate the license file).

So I have several obstacles to overcome here.

1) I have to use Java 1.5, which as i understand takes getting the MAC address from easy to not-so-trivial.
2) I have to figure out how to encrypt and decrypt this file.
3) I'd also like to make it so if they've messed with the file at all, it nullifies the license.

My questions:

1) Is the MAC address my best option here, and if so, how do I get it with Java 1.5 ?
2) What's a good plan of attack to do the encryption.

As interesting as this is, I would love to be able to do a lot of this without re-inventing the wheel.


To answer anticipated questions:

1) I haven't decided to do it this way, it's how I was told to do it If there is a better way though, I am open to suggestions.

Thank you everybody for your time, and if I've placed this in the wrong forum, I do apologize in advance. This is my first real big step out of my normal Java "comfort zone", so I'm sort of excited

[Martijn Verburg]

MAC address is about the best you're going to get. unless you dive into further hardware analysis in order to identify a machine uniquely. However, you mention user names? If you're talking about people as opposed to machines, then your scheme won't work as people can easily shift machines.

There is plenty of crypt/decrypt support within Java itself and free 3rd party libs, so that should be no problem (Google it first, you'll find sample code pretty quickly).

How to get the MAC address? In 1.5 you'll probably have to find some existing coded out there as it's different per platform (or you can write your own util class that executes OS specific command and reads the results), as you say under 1.6 it would be simpler

Best of luck!

[Jason Richard]

Hi again,

So getting the MAC address, pretty easy.

Getting things to encrypt and decrypt, not so bad.


The one thing I'm still stuck on is getting a static key.

I don't want

Key key;


KeyGenerator generator;
	generator = KeyGenerator.getInstance("DES");
	generator.init(new SecureRandom());
	key = generator.generateKey();

because that gives me a new key every time. I want to be able to read a key from a file, or even hard code it (not trying to make this super secure, just enough where somebody who doesn't have a license KNOWS they shouldn't be doing what they are doing if they get around things.

I'd like to be able to just have

Key key = new Key("SOME VALUE that will be the same everytime I see it");

But I'm really not seeing that explained very well anywhere.

[Martijn Verburg]

this thread might be of some help.

[Jason Richard]

Martijn Verburg wrote:this thread might be of some help.

Thanks, I'm still slightly confused though. I was able to get a very basic one line encrypt/decrypt going, but now my biggest issue is reading and writing to a file in a way that I can snag these things line by line so i can check.

I know I'm using very basic bytes here for encrypting, I will adjust that once I know what I'm doing. I'm also not looking for super security, but more of a "if you are breaking this, you know you are breaking this and you are being a bad bad man" type security for now.

In this code, I'm reading in the file, and encrypting it

private static byte[] rawDESKey ={ 0x0a, 0x01, 0x02, 0x03, 0x04, 0x0b, 0x0c, 0x0d };

				System.out.println("attempting to open file: " + args[0] + "\r\n");
				FileReader fr = null;
				BufferedReader br = null;
				
				try
				{
					 fr = new FileReader(args[0]);
					 br = new BufferedReader(fr);
				}
				catch (Exception e)
				{
					System.out.println("file not found: " + args[0]);
					return;
				}
			
				SecretKey key = new SecretKeySpec(rawDESKey,"DES");

FileOutputStream out = new FileOutputStream("license.txt");
				
				Cipher cipher = Cipher.getInstance("DES");
				cipher.init(Cipher.ENCRYPT_MODE,key);
				
				
				String line = br.readLine();
				
				while (line != null)
				{

byte[] cyphertext = cipher.doFinal(line.getBytes( "8859_1"));

				//System.out.println(new String( cyphertext, "Cp1252") );  
				out.write(cyphertext);
				 out.flush();
				 
				  line = br.readLine();
				}
				
				out.close(); 

Then in this program, I want to decrypt the file, and verify my data:

try {
		byte[] rawDESKey ={ 0x0a, 0x01, 0x02, 0x03, 0x04, 0x0b, 0x0c, 0x0d };
			
			SecretKey key = new SecretKeySpec(rawDESKey,"DES");
			
			
			FileReader fr = null;
			BufferedReader br = null;

			try {
				fr = new FileReader("license.txt");
				br = new BufferedReader(fr);
			} catch (Exception e) {
				System.out.println("no license file found");
				return false;
			}
			
			
			Cipher cipher = Cipher.getInstance("DES");
			cipher.init(Cipher.DECRYPT_MODE,key);
			
			
			String licenseID = br.readLine();
			// convert to bytes
			byte[] licenseBytes = licenseID.getBytes();
			System.out.println(licenseBytes.length);
			
			
			byte[] decrypted = cipher.doFinal(licenseBytes);
			
			String macAddy = new String( decrypted, "Cp1252" /* encoding */ );
			
			String os = System.getProperty("os.name");

			if (os.equals("Windows XP"))
			{
				Runtime rt = Runtime.getRuntime();
				Process ps = rt.exec("ipconfig -all");


				InputStream in = ps.getInputStream();  
				BufferedReader reader = new BufferedReader(new InputStreamReader(in));  
				String line = null;  
				

				while( (line=reader.readLine())!=null){  

					
						String tempLine =  line.trim();
						if (tempLine.contains("Physical Address"))
						{
							if (tempLine.contains(macAddy))
							{
								if (tempLine.contains(username))
								return true;
							}
						}
					

				}
				System.out.println("This user:" + username + " not registered on this computer");
				return false;
			}
			else
			{
				System.out.println("License not implimented on OS: " + os);
				return false;
			}
			
			
			
			
		} catch (InvalidKeyException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
			return false;
		} catch (UnsupportedEncodingException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
			return false;
		} catch (NoSuchAlgorithmException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
			return false;
		} catch (NoSuchPaddingException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
			return false;
		} catch (IllegalBlockSizeException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
			return false;
		} catch (BadPaddingException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
			return false;
		} catch (IOException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
			return false;
		}

So the error I get back, is

javax.crypto.IllegalBlockSizeException: Input length must be multiple of 8 when decrypting with padded cipher
at com.sun.crypto.provider.SunJCE_h.b(DashoA12275)
at com.sun.crypto.provider.SunJCE_h.b(DashoA12275)
at com.sun.crypto.provider.DESCipher.engineDoFinal(DashoA12275)
at javax.crypto.Cipher.doFinal(DashoA12275)
at sasi_loader.ASI_Loader_Launcher.checkLicense(ASI_Loader_Launcher.java:89)
at sasi_loader.ASI_Loader_Launcher.main(ASI_Loader_Launcher.java:227)

So I know i need to either change something in the way that I write or read this file, if not both, but I"m not quite sure how. I tried following the link that Martijn and Included (and thank you for that) but I'm still confused. Can anybody help?

[Martijn Verburg]

Without knowing anything about this area, have you tried:

1.) Getting the length of the input (seeing that's what it's complaining about).

2.) Ensuring that the encoding is consistent throughout (remember some encoding schemes use 2-bytes or more per character, some use 1). You need to make sure it's consistent across each read/write.

That's off the top of my head anyhow.

[Paul Clapham]

I'm not sure the getting the MAC address is as easy as you think it is. For example my computer has two of them (one for the place where you plug in the cable connecting you to the LAN and another for my wireless connection). I don't think that's unusual for computers these days. Which one are you going to use? And if my LAN is down and I connect via wireless, do I fail the licensing check?

[Jason Richard]

Martijn Verburg wrote:Without knowing anything about this area, have you tried:

1.) Getting the length of the input (seeing that's what it's complaining about).

2.) Ensuring that the encoding is consistent throughout (remember some encoding schemes use 2-bytes or more per character, some use 1). You need to make sure it's consistent across each read/write.

That's off the top of my head anyhow.

When I write out each of the

out.write(cyphertext);

each line is a multiple of 8 (16, 32, etc)

when i read the line in:

String licenseID = br.readLine();
			// convert to bytes
			byte[] licenseBytes = licenseID.getBytes();
			System.out.println(licenseBytes.length);

Its giving me a value of 60, which is not a multiple of 8. Sorry i should have been more clear on that.

I think I just need to write each line on it's own line on creation (it's just adding to the same line), but i wasn't sure how.

[Martijn Verburg]

A couple of things:

1.) I notice you use "8859_1" to write but a different encoding to read. You'll want to be consistent there.

2.) Line endings, are any of those being written? (I don't think the write() method does this, but perhaps some are being inserted manually).

3.) Oh, how many iterations is the write() being called?

[Jason Richard]

Paul Clapham wrote:I'm not sure the getting the MAC address is as easy as you think it is. For example my computer has two of them (one for the place where you plug in the cable connecting you to the LAN and another for my wireless connection). I don't think that's unusual for computers these days. Which one are you going to use? And if my LAN is down and I connect via wireless, do I fail the licensing check?

The getting the lan address became the easy part. This code is being specifically designed to only be used by certain users on certain machines on a very limited basis, so the MAC address is exactly what we need here.

[Jason Richard]

A couple of things:

1.) I notice you use "8859_1" to write but a different encoding to read. You'll want to be consistent there.

That's what I thought too, but when I did that I was getting even stranger data. Not saying you aren't right, you probably are, but this worked in the straight up one for one case (one write to file, one read from file)

2.) Line endings, are any of those being written? (I don't think the write() method does this, but perhaps some are being inserted manually).

NO! And i figured i'd need a '\r\n' or something, but i wasn't sure how that would work on the read. Plus the

out.write(cyphertext);

wants an int, and I wasn't sure how i do that yet

3.) Oh, how many iterations is the write() being called?

The write iterations will vary based on the number of lines we read in, it could change from file to file. IT could be anywhere from 1 read to 1000 reads.

[Jason Richard]

So it looks like for me, i need to either

1) write returns somehow, though it looks like FileOutputStream doesn't like to do

2) write and read using a different method.

I'm not too picky

[Paul Clapham]

Normally when you use encryption, you generate an array of bytes. These bytes are just numbers and don't represent any text, so writing them somewhere as text (e.g. with a Writer of any kind) is a mistake and will just lead to problems. Likewise trying to read them with a Reader won't work either.

If you want a text representation of those bytes, then Base64-encoding them or hex-encoding them would do that. You can then write the result of those encodings to a licence file, and read them back and reverse the encoding to get the bytes back.

Or you could just write the bytes to a file (with a FileOutputStream) and then read them back as bytes (with a FileInputStream).

[Jason Richard]

Paul Clapham wrote:Normally when you use encryption, you generate an array of bytes. These bytes are just numbers and don't represent any text, so writing them somewhere as text (e.g. with a Writer of any kind) is a mistake and will just lead to problems. Likewise trying to read them with a Reader won't work either.

If you want a text representation of those bytes, then Base64-encoding them or hex-encoding them would do that. You can then write the result of those encodings to a licence file, and read them back and reverse the encoding to get the bytes back.

Or you could just write the bytes to a file (with a FileOutputStream) and then read them back as bytes (with a FileInputStream).

That's what I thoguht i was trying to do, only i write out the bits in groups in multiples of eight (mosty 16, but some 24, and 32) and when i try to read back , i read a line and it's 60, so then it doesn't work.

[Paul Clapham]

There aren't any "lines" in a file where you just write a bunch of bytes. Your original code (way back there) appeared to be using a Reader, which doesn't make sense for bytes.

[Jason Richard]

Paul Clapham wrote:There aren't any "lines" in a file where you just write a bunch of bytes. Your original code (way back there) appeared to be using a Reader, which doesn't make sense for bytes.

YES! I am so much closer, but not there yet.

So here's what I've switched to:

For creating the file

			try {
		
				byte[] rawDESKey ={ 0x0a, 0x01, 0x02, 0x03, 0x04, 0x0b, 0x0c, 0x0d };
				
				SecretKey key = new SecretKeySpec(rawDESKey,"DES");
				
				
				FileOutputStream out = new FileOutputStream("license.txt");
				
				Cipher cipher = Cipher.getInstance("DES");
				cipher.init(Cipher.ENCRYPT_MODE,key);
				
				
				String line = br.readLine();
				
				while (line != null)
				{
				
				System.out.println ("Encrypting: " + line);
				
				byte[] cyphertext = cipher.doFinal(line.getBytes( "8859_1"));

				out.write(cyphertext);				
				
				 out.flush();
				 
				  line = br.readLine();
				}
				
				out.close(); 
			}

and for reading the file

try {  
				byte[] rawDESKey ={ 0x0a, 0x01, 0x02, 0x03, 0x04, 0x0b, 0x0c, 0x0d };  

				SecretKey key = new SecretKeySpec(rawDESKey,"DES");  

Cipher cipher = Cipher.getInstance("DES");  
				cipher.init(Cipher.DECRYPT_MODE,key);  
				FileInputStream in = new FileInputStream("license.txt");
				InputStreamReader isr = new InputStreamReader(in);
                int ch=0;
                StringBuffer buf = new StringBuffer();
               
                
                while((ch = isr.read())> -1){
                         
                        buf.append((char)ch);
                       
                }

 byte[] decrypted = cipher.doFinal(buf.toString().getBytes("8859_1") ); 
                String t = new String( decrypted);
                System.out.println(t); 

so I'm seeing the data get decrypted "almost". I can make out some of the data so i can tell we are decrypting, and i know my problem is with the encoding/decoding. I'll be playing with it all day, but if anybody sees where I am screwing up, much love for you!

[Jason Richard]

bah check that, i'm back to no padding errors.

[Paul Clapham]

Um, you're still using a Reader to read data that isn't text. Don't do that. Like I said before, just read the bytes.

From your code it looks like you're hung up on the idea of lines in your encrypted data. Don't do that. In fact right now you're dropping the line endings from the plaintext and not encrypting them. Don't do that either. In fact, don't treat the input data as text either. Read it as bytes, encrypt the bytes, and write the encrypted bytes to the output. To decrypt, read the bytes, decrypt them, and write the decrypted bytes to the output.

[Jason Richard]

Paul Clapham wrote:Um, you're still using a Reader to read data that isn't text. Don't do that. Like I said before, just read the bytes.

From your code it looks like you're hung up on the idea of lines in your encrypted data. Don't do that. In fact right now you're dropping the line endings from the plaintext and not encrypting them. Don't do that either. In fact, don't treat the input data as text either. Read it as bytes, encrypt the bytes, and write the encrypted bytes to the output. To decrypt, read the bytes, decrypt them, and write the decrypted bytes to the output.

Nice,

Ok, I took out the reader, and just reading from the input stream and now i'm getting results like this:

decrypted: username,macjason,23-23-43-23-21bob,23-a3-af-e3-af-23

so I'm pretty good, now i just have to parse that line properly. Thanks for the help!

[Paul Clapham]

What "line"? Don't treat anything as if it had lines. Not the plaintext nor the ciphertext. It's all just a series of bytes.

[Jason Richard]

Paul Clapham wrote:What "line"? Don't treat anything as if it had lines. Not the plaintext nor the ciphertext. It's all just a series of bytes.

it was, but once i read it, i dropped it back into a string, so now it's a line again right? So now I have to use my unencrypted data in that string and compare it to what i read for the MAC address