title: A licensing system for my (WinForms) application. Would this be secure enough? (Within reason)
body: <p>I have researched on each element or system that I am willing to implement into a generic software licensing system for my soon-to-be apps (irrelevant, as this should work, or be usable on all of my applications).</p>
  
  <p>I have created a DLL with my licensing class in it.
  It is as follows:</p>
  
  <hr>
  
  <h2><strong>(1)</strong></h2>
  
  <p>I have applied the <strong><code>InternalsVisibleTo()</code></strong> attribute main class (with child classes), which makes all of the internal classes, and their methods, which are declared <strong><code>Friend</code></strong>, visible to external assemblies with the sepcified PublicKey.</p>
  
  <p>I have made the reference to the app name, and it's PublicKey. (Both the licensing, and the external assembly, are signed with the same key (<strong><em>.snk</em></strong> file)</p>
  
  <h2><strong>(2)</strong></h2>
  
  <p>All (where possible) members, properties etc. are delcared <strong><code>Friend</code></strong> or <strong><code>Private</code></strong> or just <strong><code>Dim</code></strong>...ed .</p>
  
  <h2><strong>(3)</strong></h2>
  
  <p>My licensing class has a <strong><code>String</code></strong> variable; declared:</p>
  
  <pre><code>Private Shared _Key As String = "H58N2-00V93"</code></pre>
  
  <p>This variable is the special password, if you will, of my DLL, and is required to access the methods in my DLL.</p>
  
  <p>There is also a <strong><code>Public String</code></strong> variable (let's call it "<em><code>AccessKey</code></em>"), which should be initialized with the main class, like so:</p>
  
  <pre><code>Dim licDLL As New LicensingAssemblyName.LicensingMainClass With {.AccessKey="H58N2-00V93"}</code></pre>
  
  <h2><strong>(4)</strong></h2>
  
  <p>Then, I have a <strong><code>Function</code></strong> (let's call it "<em><code>CheckKey</code></em>"), which checks whether the <strong><code>Public</code></strong>, initialized variable ("<em><code>AccessKey</code></em>" is equal to the pre-defined, <strong><code>Friend</code></strong> key ("<em><code>_Key</code></em>"), whereupon an exception will be thrown, if they are not equal - preventing method from continued/used.</p>
  
  <h2><strong>(5)</strong></h2>
  
  <p>At each first line of every <strong><code>Sub</code></strong>, <strong><code>Function</code></strong> etc., I have inserted a call to this function.</p>
  
  <hr>
  
  <p>These are just the 'security' measures I've taken to prevent external assemblies from using my DLL in another app, to perhaps exploit the system or generate keys.</p>
  
  <p>Now for the licensing measures.</p>
  
  <hr>
  
  <h2><strong>(1)</strong></h2>
  
  <p>I have a key generator (very basic), which generates codes upon a given format (Like: "<code>#-$</code>" for a number, a dash, followed by a letter.)</p>
  
  <p>I have included an encryption class in this program, which uses <code>Rijndaenal</code>, and applies salt.</p>
  
  <p>I have set the key generator to encrypt each separate key upon generation, then append it to a new line of a file, which we'll call "<strong>my_licenses.txt</strong>".</p>
  
  <p>I use the same password for each one (obviously). It is quite long, and includes many different characters (if that makes ANY difference). I considered this to be a secure way since I didn't think ANYONE could decrypt a string without the password, until I was told by another programmer, who advised against using plain text encryption as a method to secure these keys. Please help me with this.</p>
  
  <h2><strong>(2)</strong></h2>
  
  <p>In my licensing DLL, I have a declaration:</p>
  
  <p><pre><code>Friend Shared Function IsKeyValid(ByVal KeyDB As String, ByVal Key As String) As Boolean</pre></code></p>
  
  <p>This function decrypts each key in the file (the specified database, using the same pass code used when encrypting them in the key generation program).</p>
  
  <p>Then I do a <code>For Each</code>, <code>Next</code> loop to, determining whether the specified "<em><code>Key</code></em>" value equals any in the key 'database', "<strong>my_licenses.txt</strong>". But here's the catch.</p>
  
  <p>I have an <strong><code>Function</code></strong> which returns a unique code for the computer it's running on (using hardware IDs etc.). This <strong><code>Function</code></strong> helps me protect against the use of the same key on multiple computers (unless I implement a system for allowing this, limited times) and is required as the last 5 characters of the "Key".</p>
  
  <p>After checking, this Function returns a value of the result (<strong><code>True</code></strong> or <strong><code>False</code></strong>).</p>
  
  <hr>
  
  <p>Finally (phew), each assembly (the licensing one, and any external ones which utilize it) are obfuscated -and likewise signed (all assemblies, with the same key (<strong><em>.snk</em></strong>) file)- by <strong>CodePlex's Confuser</strong> (A free, and highly recommended obfuscator for <strong>.NET</strong>).</p>
  
  <p>I hope this hasn't been too long/not detailed enough/difficult to understand. (If so, tell me what you don't understand).</p>
  
  <p>This is my first post/question of any kind, so be nice. Also thank you for reading.</p>
  
  <p>I hope you can help.</p>
  
  <p>And just to confirm, my question is this: Would this system be secure enough to protect against the average hacker?</p>
  
  <p>P.S. I am only a beginner, so answers for a beginner would be especially appreciated ;)</p>
  
  <p>*<strong><em>UPDATE</em></strong>: I have actually reduced the length of this question, and improved its understandability (believe it or not). So this is the best I can do.</p>