Managing encryption keys in an application with add-on components

Question

I am developing a product that uses custom hardware with accompanying software. It requires additional components which are sold separately to make the overall application work.

Using these additional components makes it similar to a razor-blade style business model (see http://www.investopedia.com/terms/r/razor-razorblademodel.asp). The intention is to secure the product so that only the allowed add-on components can be used with the main product.

The technology to do this in the application is with RFID and embedding information inside the RFID tags.

To prevent easy workarounds, an approach using symmetric encryption would work however, I'm concerned with an approach that uses the same private key in every case.

Therefore I'm interested in any approaches or tips with key management for this type of application.

Answer 1

If those add-on components are like plug-ins that are loaded by the main application, and if only trusted parties (or only you) are allowed to publish those add-ons, then you could use digital signatures.

Digital signatures are based on public key cryptography. You would hold the private key that is used to sign the add-on. The main application would contain the public key that is used to verify the signature. A valid signature proves that the add-on was published by you and that it was not tapered with.

To allow trusted third-parties to publish add-ons of their own, you would simply embed their public key as well and accept an add-on if the signature validates with any of the keys.