How do 25-character product keys work?

Microsoft products and other products often have a product key that is 5 groups of 5 characters, like this:

ABCDE-12345-ABCDE-12345-VWXYZ

How does the product know if the key is valid? Some sort of crypto开发者_开发知识库graphy? Is there a library if I want to use this kind of product key in my code?

---

You might want to have a look at this article on how to implement a serial number validation function. It also goes into some advanced techniques such as how to keep on top of keygens, leaked keys, etc.

In short, there are typically three underlying fields in such a key:

• the actual serial number, which the article calls a "seed"
• some verification data; only part of the verification data is actually checked by the code
• a checksum, CRC or other simple typo-proofing mechanism

By only implementing part of the verification data checking in your code, you can do things like "genuine validation" (in which case the rest of the verification happens on your server) or trip up keygens by checking different subsets of the validation data in new releases.

---

For Microsoft products in particular, is some knowledge available.

Product keys on Windows XP are base24-encoded using a custom alphabet. It consists of a serial number (the source calls it "Raw Product Key") and a digital signature over it. source

Product keys on Windows 8 and above have some documentation in the software patent application WO 2012067888 A1. It is still base24 encoded (act 57 et seq., which in practice means that the position of the 'N' is used as the very first character to decode). The gist of it is that there are these parts to a Windows 8 and above product key:

• Group ID, which indicates the type/edition/family/distribution channel, see act 34)
• Serial number (forms "Raw Product Key" together with Group ID)
• Security values 1 and 2 (of varying grades of security, both are probably signatures, cf. acts 34 et seqq., 46, 55)
• Checksum (act 56, in practice a truncated POSIX cksum over the key)
• Upgrade bit

---

There are four ways to confirm a key.

1. Simple compare to an existing string in the exe (extremely easy to crack)
2. Algorithmic compare to an entered string of characters (almost as easy as #1. Depends entirely on the reverse engineering skills of the cracker).
3. Compare with a server over the internet. (can be circumvented)
4. Hardware dongle.

Depending on the product you have from microsoft, they use one of the first 3 mechanisms above. For example, their OS's usually phone home; but their dev tools either have the key baked in or do an algorithmic compare. Some of their older OS's used to do the algorithm.

There is a modified option 3, but that is simply having the app phone home every so often, typically based on some event. In the case of OS's, MS has it validate the entered product key for certain windows updates and other product downloads. Also, depending on the license key itself it might phone home once a month or so. As a side note, there is a reason why China has the #1 installed base of IE6.

The 4th option can also be circumvented. Usually the cracker will just patch your product to bypass the part of the code which does the hardware check.