The Application Verification

Your application must perform the following steps to verify the license system's response to the challenge:

  1. Receive the output parameters of the call to the LSRequest or the LSUpdate function, and the license system's response.
  2. Compute a second message digest with the MD4 Message-Digest Algorithm supplied by RSA Data Security, Inc. For additional information about the format of this message digest, see LS_CHALLDATA.
  3. Compare this message digest to the license system's message digest.
  4. Accept the result only if the two are equal.

There are two different methods you can use to verify a challenge response:

For additional information about coding the challenge, see Anti-Tampering Guidelines.

Algorithmic Method

With this method, you incorporate the challenge algorithm and the actual secret values in the program code. This method requires that you take steps to obscure the code and to ensure that the secrets themselves are not readily detectable. These steps are described in Anti-Tampering Guidelines.

Table Lookup Method

With this method, you incorporate a precomputed table of valid challenge responses in the program code. The table should contain a row for each possible challenge and a column for each unique secret response. Your application can verify a challenge by examining the appropriate challenge/response intersection in the table. This method requires that you choose the challenge values in addition to the secrets when you code the application.

If intruders successfully duplicate an application's challenge and response table, they can also circumvent and replace the legitimate license provider. If all the data in the table is known, the application's secrets are vulnerable. It becomes more difficult to copy the entire table while inspecting the data exchanges between the application and the license provider as the size of the table increases. Therefore, if you use the table lookup method, compute a large number of random number values to ensure that there are a large number of possible challenges and responses.

At the beginning of each run time, your application must select one of the challenge values from your table. It must then pass this value in a call to the LSRequest function. When the call returns, the application must compare the actual challenge response to the expected response for that challenge value.

A sample table follows. The format and size of the values are examples only.

Challenge
Value
Secret 1
Response
Secret 2
Response
Secret 3
Response
Secret 4
Response
1. 8675309 783ndmw732 3487dn262 367dkb37 476dndk263
2. 63JSk23 63387d6b36 7b6b5u8b7 8hn65bv4g7 076bb856v6
3. 833jh26 73d83m29s 8N7GJ829n8 89bn73nBH 89348nUU7
4. 8LES654 733nbV8 8H8hu8 B73h0dn39 7590nd73n
5. 28gHjB4 39834nd83 93n3d93n38 393n3ed83n 983n38db38

If an application used the preceding sample table and challenged Secret 3 with the second challenge value, 63JSk23, it would then pass this value in a call to the LSRequest function. A legitimate license system would respond with a challenge response of 8hn65bv4g7 and a status of success. The application would then examine the entry at the appropriate challenge/response intersection in the table and compare it to the value 8hn65bv4g7. In this case it would find a match, so the challenge response would be valid.

In addition to including a table such as the preceding example, your application could also include a similar table of challenge responses for use with calls to the LSUpdate function.

For additional information about coding the challenge, see Anti-Tampering Guidelines.