The Application Verification

Your application must perform the following steps to verify the license system's response to the challenge:

1. Receive the output parameters of the call to the LSRequest or the LSUpdate function, and the license system's response.
2. Compute a second message digest with the MD4 Message-Digest Algorithm supplied by RSA Data Security, Inc. For additional information about the format of this message digest, see LS_CHALLDATA.
3. Compare this message digest to the license system's message digest.
4. Accept the result only if the two are equal.

There are two different methods you can use to verify a challenge response:

• You can either incorporate the secrets and the algorithm in the code (Algorithmic Method), or
• You can precompute a table containing a number of random challenges with their expected responses (Table Lookup Method).

For additional information about coding the challenge, see Anti-Tampering Guidelines.

Algorithmic Method

With this method, you incorporate the challenge algorithm and the actual secret values in the program code. This method requires that you take steps to obscure the code and to ensure that the secrets themselves are not readily detectable. These steps are described in Anti-Tampering Guidelines.

Table Lookup Method

With this method, you incorporate a precomputed table of valid challenge responses in the program code. The table should contain a row for each possible challenge and a column for each unique secret response. Your application can verify a challenge by examining the appropriate challenge/response intersection in the table. This method requires that you choose the challenge values in addition to the secrets when you code the application.

If intruders successfully duplicate an application's challenge and response table, they can also circumvent and replace the legitimate license provider. If all the data in the table is known, the application's secrets are vulnerable. It becomes more difficult to copy the entire table while inspecting the data exchanges between the application and the license provider as the size of the table increases. Therefore, if you use the table lookup method, compute a large number of random number values to ensure that there are a large number of possible challenges and responses.

At the beginning of each run time, your application must select one of the challenge values from your table. It must then pass this value in a call to the LSRequest function. When the call returns, the application must compare the actual challenge response to the expected response for that challenge value.

A sample table follows. The format and size of the values are examples only.

If an application used the preceding sample table and challenged Secret 3 with the second challenge value, 63JSk23, it would then pass this value in a call to the LSRequest function. A legitimate license system would respond with a challenge response of 8hn65bv4g7 and a status of success. The application would then examine the entry at the appropriate challenge/response intersection in the table and compare it to the value 8hn65bv4g7. In this case it would find a match, so the challenge response would be valid.

In addition to including a table such as the preceding example, your application could also include a similar table of challenge responses for use with calls to the LSUpdate function.

For additional information about coding the challenge, see Anti-Tampering Guidelines.