menu
 

Offline Licenses

What is an offline license?

An offline license is a license that can be used in an offline or air-gapped computing environment, i.e. a device that has no or limited access to the public internet.

The simplest offline licenses are those which allow you to check their "authenticity", that the offline license key was indeed created by you. They have no embedded data, or at least, the data that is embedded into the key is not utilized within your code, i.e. it has no value.

More complex offline-capable licensing systems may have a useful dataset embedded inside of the key itself, which can be decoded/decrypted and utilized in your software. Embedded key datasets may include things like license expiration, grace periods and offline use limitations, customer and device information, and general license entitlement data.

How do I implement an offline license?

The easiest way to get started with an offline-capable license is to add a cryptographic scheme to a new Policy. Choosing a cryptographic scheme will instruct our systems to encrypt or sign all license keys which implement the Policy.

Many of these solutions can be packed into an easy-to-use and easy-to-distribute license file or certificate, and delivered via email, USB key or other means. This isn't required, but it does offer a better user experience when activating offline devices compared to copy and pasting (or worse: hand-typing!) long cryptographic license keys.

Cryptographic license files

Signed (and optionally encrypted) license files can be used in offline and air-gapped environments to distribute tamper-proof license and machine data. A license file consists of an encoded certificate, which typically looks something like this certificate below:

-----BEGIN LICENSE FILE-----
eyJlbmMiOiJsSTc4N0QwcGZua1RvRDVOSjFpRXlaU093Q09QQ0NOdktKZHpC 
MlpSYlZBQzVsQUhjdzJSUi8xTEhrcXc0ZG5rUEl3TFVYRzhmUzk1R0JWTmtz
d2JDTmllWm1uOElHeGpkbUY2T1RmNjRzOHlpbFRpL3FlUzJSTlhBdGJBWjUw ...
QWtpVnBudmFWTFhVdkY1UGJJYjNFRXA0YlZNOU1xWjBhNjhQa1R1MW5VS0E0
QWRnV1FHWU1tU2hKdmIxbys0UFozYXU3a1FuWkZ1bWNPUUdUcllYRng1YVpZ
Wkw3SzhGMWFFRWh1clNmNzdwa25yWXRScnBmS2tUT2QvN3RaUXhQSW16bWpj
OTVGeWJlY0ladndEU2NTNGpRM2VCYlU0cHRFd056dlc5ay9JRFBja2N2eWdB
NFhhUnFsRkNZYlRDa1R3LzBZbUVxQnJVTThCYWpFZ3dTRWdvNG44c2N0UTNJ
VncxYkx6cnVFWDEzY1B3eXE1UDM5SVY5TFlhUjhVYmZBR0tBT0YzbGlPZUpp
ZStmKy96cDFGK2NrcFBIM3J6OW5XbTVjOEFzWkxKeUR3NmFBK1hDRHdmRThl
WXdrQlpLTFB4SUJ5Qm9QemIwaU5NWmwya25sU2R1d2hZNUhIVktKbTVKWXR1
eGVHK1FOcjFEZXg2NlVXWGJuVHNKT1M3Mlo4NVBBZFFSTjV4SmlHVW92akE0
anI2RVJDcDBtWlhMQnM2RXljb2tnYi91cFRWRDV0Y0lRZ2YvSkZGcC96VnNr
UjNDdEl5UHk2YUZUNGZIM1N3djFxZ1p6OHBtcUM0aDB6OWR1WlhXeUdzM0p1
aGJSWmFpMG9IOTA5Z1V0anR4MHJ4SEg2OUdBamtHWCtQQ2w4QlN4ZlBPMVJs
TktPSmw2ckZZVzVac0pIUWhzNnQvZkx5eGJUTEg5YVlUNm5sV0s0eUZ3M3JI
VC9oMnlia0NJSjFtMGRQV0pFTkhqTGFzLzFZME5XK28rbXYvR2UyT2NlZ3Fj
Q2QxSmFLTis3dk13eTlSQ050d1IyeUt1dWIrQzU2aVdhVjQvanNqbmZyVHFZ
OU0reFZuNlFNM3djVUhwODJ3TzlySWNQOCtxcWtVQmQrYjUxMnVyUW5EbFRO
bi9JRE1jWGs5SUVWV09QQXdNMDBCV0U5TTFmU2xaTjRldlh6akx6N0c5L3dE
bGsxZThMU0FDTEhzcUFSVEZVNzhLMmp3bmlodW9UeHE4TlNSLyswS013elVa
VE03WGVHQnVHZVhZT25XUG5YUzlsRFJ6QlMrbE1sT0tZQTJxZzMrSEJSRDR0
bS9XaGpRWFRQN250bEQ1MUFKRDRrc3U1NER2dWlqaXJoQmNwaVNYbjliRzV4
dE8vQ0dhNlJQbGJJWkxaTjRnY1FjeDhkckdXV0Z2QnA4YVVqVlBWNlFoZ0lq
REpDNG9QcDBXNkgyUEdFTC9jbXRMV3JaOVMzTUcvWFRHazFVZnZtNGFMekdQ
aEoyRGw4TFV3TEhmbGNvVEYvUFg3dDQ2aUlMQnpXdlV4MmU4MEpMakNMaXkr
U1VOcnJTMXhqdUQ2R0NqWU9DeVh5TUhJYmlwd09PVEJKbXdvYmorWEh4QkZQ
Y0J5bnBYVlM5ZWVlbEE5Nk8yV0xRZVdFYkFMQXJTcyt1RXJqSjFDZ3o5RjdD
VjFnNGp5M2VPQVRDTUJHK1JlVE9KSUdyQ2xmZkt2N2laMmxKS1p4VTRodnEx
TjVwaEVwZ09KUC91K1M1Zi8zaFBHaXRIVUw0VzFJbS9CR1E3WDFQMHNmbkky
SDJlVm8vRmU0L0J0VHQ0eUVUK1lpUkJyWGNsZWxUTWM0R0pENzRocVI4RGxx
Y0VBLy8xWThnSldCQlNqa0hHYlpiMHRsZ0ZnenpuYzAxUDRJVXByQ21ueEkz
eXVVVXJWNDlQL25UcGRkVzJoNDFpUzNoSitSdzVuaHk0QWhZVDdOTVFER1h1
cEw3Q29BUWphb0FTc3NZdGJSWDhheGdocTk5a1BYaVRCVVIycEM4ZHpaMnBt
bGVqZjY1ck15TktabkRtWkNDanBIS1R3MnpnUzU2V3hoUXdxbnRoRlR0R2pr
TllKWDEyMm5McVF6T0crTThzWitqUDEzNWRGUUo3L1Y2eFNWOHFnRkJGaHVu
eHk3N3NoNXZadzVNaDNlOFQvMzh6d3FqYWpCWlYraDVPU05veEpjMlJrMGgx
TjFlaUc2TUtUMDVlNDNVRkczcTBKNkJGdHkvL25qYU9EM1ZpVVBadkxGTEVp
ZFo0eG4vRzg0WDhjNDFtUjd4SEZmbVIxcTFTeTBYRFZLT2laRnhxdDJyYU5R
V0wrWlQ2bWRDMEliNkg3Rm55cjdpbHFzRzNCWjNVbjE4UkRmdlkrb3NjNlN0
bDA1bEoxdTJYTUNvZ2xEZDJpcnNzSjBZL29DU0Q1ZVE0SnRtL0xrSk81T0Z0
ckJ5VnZEUGZkZ2ZTUnk4UU5pamNSNFBJUXBsNkNUQjJXQjBQWFN5VmRiaFVp
RWZncE8xeXJRYnJobFFya0pPTFlDdnMwNCtMVjdUclVoRTF2aXFLY2ZVUXMw
QnVvNjZOSy8yZDBJOWprRnM4ZzlWSzFqcE9RUU9BVjNoZTA1T01Lck5nNW5N
UktPYTQxTUF5U1FpVlg3NHZhdEF3Y0lSelBTTmlOUFR3emFDdllBNUx3d0ov
UW1kblpHeEVBSFZRV0VwKzBzNDNVc2lRMFNTdDRMVjVlMWlZMDl1aks4b2th
azB6ZGUrRHd0RTlqdzlzTEhTdzRzZGpUUzNIZEN6aFZmVms0ZXZDZVB4NDhw
Qjk2QllFUHh5SCs5SUppcXE2eU8xTnRIZHBlWUk3TWpueTV6RkEzTk5UdkR1
N0FOMmhnT0R2OXBUM2ZNWklZNnNua0RiU0RyVXhhMnBRUldaU3ZtK2hHeUow
bHo2ZnhoU0FmM3hRaGpCb0V6bnRlblNTZm1QWEpLbmJoMmJhTnNrdVVIb1lO
MVNmL2orRUxCU1dTd0NSbWtOZGI1UkhCQWswdk41QmVLSDVPM3ZlZXRBc2Nj
dGZMV0R3aDliWnB4ZHVLaFVMeTdLQXl4S1pFbjloWFVUMzhaKzFGTVdzY3RJ
bDB2anZSSXdpbkMwNFRPUHVqSkh0NXJkMVZRZ0pkTGNDdzQ5TThuSzRSbjlI
NkwwVWM2dUc4cWRHZXhLY2xyZU1KWmxCTlJsVm5pTzc0VnVoMkVMajk5UWJ2
VUhTZ205QllHZmk4aDAwNUFGb0VvNDRxNnpYK0ZNc3daR0txQUpQd0ZCd0x1
VGNsa1BIemYvUjlzazZQSkNrOWF1M0t4end3R1ArMkM0RzRaSEhGcUI4dVhl
dlYyZmR6SExTbTc2cTNkYlRVZ285YXJWLzZBc2ZTaFJacW9HZlhHNVdGRjBs
YThMNU0zb21XY3JSeUR6R2ZwQ1BwUXJJNFQyUnN5Vmp6NDFwNHB0dEpUd0ll
a0tucEtjOWsvcFliR1hodi82cHFpY1hhN1Q5bUplT2Uxc1AxYm15UmJPTWor
WXJadmVDaGlrTFFCQlI2U2gwMG5UNHpYL1l2RjRjNVNNM3NKK1pTejVaVXRJ
SGZiOFRrNWdsYWlzN2VYNTdjYXlxOHdmeVFSOVJlQzNPR0l5YWUyblZ4ZzE3
RDBOeXBxTFJBOXFRMU1TSEFka2ZSMEdsWUpueFF4NThtT1J4Z2Fia2V5MExL
eE5hRzdzaytKMVljRnUyTEhCNnp3S0t0dThLZGdtVTdHdHZoZz0uQmFHSEZJ
TExMQ3dNb3RkRC5pejZ5N1NxS0R0QXhGWTNsUlluMVZBPT0iLCJzaWciOiJy
MWFjNjFocUcramZsc0p1RjFTUWRxUUQvYTd3L1Y4QndDMWNvdU5iaHo5ai9s 
TlJWWGp6Ym5DRkF6V3lOU3NUeG9xZm9MV2FlWlhITEZnR21Ub2VBdz09Iiwi
YWxnIjoiYWVzLTI1Ni1nY20rZWQyNTUxOSJ9 
-----END LICENSE FILE-----

This certificate is cryptographically signed using Ed25519 or 2048-bit RSA, and optionally encrypted using AES-256-GCM.

The embedded data payload contains a tamper-proof snapshot of a license or machine resource, with any included relationship data, as well as metadata indicating the expiration date of the license file.

License files can be generated via the API from an internet-connected device, such as a mobile device, and then transferred to devices in the air-gapped environment using email, a USB drive or other means.

The following cryptographic algorithms are available:

  • aes-256-gcm+ed25519
  • aes-256-gcm+rsa-pss-sha256
  • aes-256-gcm+rsa-sha256
  • base64+ed25519
  • base64+rsa-pss-sha256
  • base64+rsa-sha256

For further information on license files, check out the API reference.

View Documentation

Signed license keys

Signed license keys are made up of an encoded dataset and a signature. These values can be parsed in your software application and crytographically verified using ECC or RSA.

Below is a breakdown of a signed license key's format:

Diagram of a signed license key

The encoded dataset is completely under your control, and can be arbitrary text, a JSON object, XML, or any other text format. But you can also use the default dataset, which is a JSON object, if you don't have any specific requirements. In this example, we'll use the user's email.

Parsing the dataset and verifying its authenticity can be performed like so:

Diagram of verifying a signed license key

The signing prefix and encoded dataset are delimited by a / character (forward slash), while the signing data and the signature are delimited by a . character (dot).

The following policy signing schemes are available:

  • RSA_2048_PKCS1_PSS_SIGN_V2
  • RSA_2048_PKCS1_SIGN_V2
  • ED25519_SIGN

For further information on signing schemes, check out the API reference.

View Documentation

Encrypted license keys

Encrypted license keys are similar to signed keys, but the format is a lot simpler. Encrypted licence keys solely consist of an embedded dataset. In this example, we'll use the user's email address as the embedded dataset.

Below is an example of decrypting an encrypted key:

Diagram of decrypting an encrypted license key

Successfully decrypted keys can be utilized within your software, or discarded after a successful decryption if the embedded dataset is not needed elsewhere. Encrypted keys that fail decryption should be considered invalid.

The following policy encryption schemes are available:

  • RSA_2048_PKCS1_ENCRYPT

For further information on encryption schemes, check out the API reference.

View Documentation

Common embedded datasets

Common values we see embedded inside of cryptographic keys:

  • An expiration date (keep in mind that embedded data is immutable so expiration dates may not be the best choice for a renewable key)
  • The duration a license is allowed to be offline (e.g. 1 year of offline use before an online reactivation is required)
  • A fixed "grace period" for the license (e.g. the license is allowed to be used for 5 days after the expiration date)
  • The maximum application version to which the licensee is entitled
  • Known hardware or appliance identifiers (e.g. for node-locking licenses up-front)
  • Customer or licensee information (e.g. email address)
  • Other entitlement information

Code examples

Here are a few code examples our team has put together for implementing cryptographic licensing schemes in offline and air-gapped environments:

Here are some examples of utilizing response signatures:

Perpetual LicenseTimed LicenseFloating LicenseNode‑locked LicenseFeature License
Expiration DateNoYesOptionalOptionalOptional
Activation LimitsOptionalOptional> 01Optional
Feature LimitsOptionalOptionalOptionalOptionalYes
Offline SupportYesYesYesYesYes
Learn MoreLearn MoreLearn MoreLearn MoreLearn More