Hi to all
,
this is my scenario:
- assumptions: A .jar file with all classes signed.
Ok, i've choose the key file solution.
The key file is 'hashed' with sha-256 then the calculated hash is crypted by ECDSA algo.
My app test the genuine of key file in this way: remove crypted hash, recalculate sha-256 and then decrypt sha-256 hash and compare them.
The keygen is impossible... but remains the byte patching approach.
My request is... there is an efficent solution to avoid the byte patching?
All suggestions are accepted...
PHP Code:
key file template example:
---------
user=testuser
email=test@test.it
hwId=111-111-111
signature=%%
------------
sha-256 + ECDSA encrypt
user=testuser
email=test@test.it
hwId=111-111-111
signature=%[(sha-256 <= ECDSA encrypt)]%
My apps remove signature and recalculate sha-256 hash
---------
user=testuser
email=test@test.it
hwId=111-111-111
signature=%%
------------
if(new sha-256 == ECDSA decrypted (sha-256))
print "good"
else
print "bad"
Thanks in adv,
DaGoN