3 ms·
Could you elaborate on this, not necessarily the code itself, but about signing and "an ec". I'm new to this and will be wanting to provide licences for softwar
by daemin 3y ago
Could you elaborate on this, not necessarily the code itself, but about signing and "an ec". I'm new to this and will be wanting to provide licences for software in the future.
- scosman 3y agoEcliptic curve signing. You can produce a message body like “valid_until=2025-02-25” then sign it and distribute it as an api key that’s body+sig. Client can verify signature using public key without a server call (sig validation). EC beats other signatures because signature is muuuuuch shorter, so it can still look like an API key.
- evgpbfhnr 3y ago"an ec key" (elliptic curve) is just a detail, this can be done with any crypto library or utility - for example directly with the openssl command: https://stackoverflow.com/questions/15686821/generate-ec-keypair-from-openssl-command-line/51179147#51179147 https://stackoverflow.com/questions/15686821/generate-ec-key... embed the public part in your application and you can verify that something signed with the 'dgst' command and the private key really has been signed with the private key (which you obviously shouldn't publish) (Note if using plain commands there is more friendly than openssl, minify/signify are much harder to get wrong, but I'm not sure they're as easy to use programmatically in as many languages there are for libcrypto/sodium/etc; this is really just an example)
- semireg 3y agoI use jwt for my app’s licensing. It works great.