I am developing a product that uses custom hardware with accompanying software. It requires additional components which are sold separately to make the overall application work.

Using these additional components makes it similar to a razor-blade style business model (see http://www.investopedia.com/terms/r/razor-razorblademodel.asp). The intention is to secure the product so that only the allowed add-on components can be used with the main product.

The technology to do this in the application is with RFID and embedding information inside the RFID tags.

To prevent easy workarounds, an approach using symmetric encryption would work however, I'm concerned with an approach that uses the same private key in every case.

Therefore I'm interested in any approaches or tips with key management for this type of application.

  • I'm afraid this isn't the kind of information you can get for free. You'll have to find a company/consultant that knows how to do this. Even if you come up with your own solution, it might already be patented. Caution, minefield.
    – user44761
    Oct 31, 2016 at 11:29

1 Answer 1


If those add-on components are like plug-ins that are loaded by the main application, and if only trusted parties (or only you) are allowed to publish those add-ons, then you could use digital signatures.

Digital signatures are based on public key cryptography. You would hold the private key that is used to sign the add-on. The main application would contain the public key that is used to verify the signature. A valid signature proves that the add-on was published by you and that it was not tapered with.

To allow trusted third-parties to publish add-ons of their own, you would simply embed their public key as well and accept an add-on if the signature validates with any of the keys.

  • Would a digital signature approach be something like PKCS#7?
    – sdbol
    Oct 16, 2016 at 21:45
  • A related question is what to do if the space is limited for storing digital signature? I mentioned RFID above and there are space constraints here. Can I reduce the key size since I believe there's a relationship between the signature size and the key size?
    – sdbol
    Oct 17, 2016 at 0:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.