Changing keyfile format of OnlineUnlockStatus

[refusesoftware]

hi Richie - sort of, I would just do:

@richie

<keyfile>
  <licensedata>
    <name>Joe Bloggs</name>
    <email>joe@bloggs.com</email>
  </licensedata>
  <signature>{RSA signature of <licensedata>}</signature>
</keyfile>

The main differences being that there’s not a separate “key” element, just the signature. And, RSA signing involves padding a hash of the content, and given the importance of getting those details right it’s the kind of thing best left to an RSA library that has RSA signature/verification functions already built in. It’s not something to roll your own version of, unless you are a crypto master.

@richie

I’m not sure I’d actually bother, given my earlier comment about wasting time I could better use building plugins…

If you already have a keyfile system in place using your prior method, I wouldn’t lose sleep over it, as it’s not likely to be the point of attack for a plug-in. However, going forward, why not do things in the most secure way?

[asimilon]

@richie

my gut feels that this wouldn’t really add any benefit somehow

Gut feel was right then

I still don’t quite understand where the padding comes into play, I think I understood that you sign a hash of the message with RSA and the private key, then to verify you check that the signature put through RSA with the public key matches the hash of the message. I also didn’t quite follow which hashing algorithm would be suitable. This is exactly why “It’s not something to roll your own version of, unless you are a crypto master.” is the best advice anyone can give, unfortunately not taken on board by everyone.