Selling Python Software

[Andrew Dalke]

Bengt Richter:
> OTOH, we are getting to the point where rather big functionality can be
put
> on a chip or tamper-proof-by-anyone-but-a-TLA-group module. I.e.,
visualize
> the effect of CPUs' having secret-to-everyone private keys, along with
public keys,

Actually, we aren't.  There have been various ways to pull data of
of a smart card (I recall readings some on RISKS, but the hits I
found are about 5+ years old).  In circuit emulators get cheaper and
faster, just like the chips themselves.  And when in doubt, you can
buy or even build your own STM pretty cheap -- in hobbiest range
even (a few thousand dollars).

> and built so they can accept your precious program code wrapped in a PGP
encrypted
> message that you have encrypted with its public key.

Some of the tricks are subtle, like looking at the power draw.
Eg, suppose the chip stops when it finds the key is invalid.  That
time can be measured and gives clues as to how many steps it
went through, and even what operations were done.  This can
turn an exponential search of key space into a linear one.

> This is not so magic. You could design a PC with a locked enclosure and
special BIOS
> to simulate this, except that that wouldn't be so hard to break into. But
the principle
> is there. Taking the idea to SOC silicon is a matter of engineering, not
an idea break-through
> (though someone will probably try to patent on-chip stuff as if it were
essentially different
> and not obvious ;-/)

But the counter principle (breaking into a locked box in an uncontrolled
environment) is also there.  There are a lot of attacks against smart
cards (eg, as used in pay TV systems), which cause improvements (new
generation of cards), which are matched by counter attacks.

These attacks don't require the resources of a No Such Agency,
only dedicated hobbiest with experience and time on their hands.

                    Andrew
                    dalke at dalkescientific.com
P.S.
  I did have fun breaking the license protection on a company's
software.  Ended up changing one byte.  Took about 12 hours.
Would have been less if I knew Solaris assembly.  And I did
ask them for permission to do so.  :)