Key a Program

This is a legacy feature that is no longer fully supported.

Despite the historic name of our platform components, the process and need for keying software is generally no longer needed in the industry due to newer license control mechanisms like user based entitlements. While the Key and Deputize features are not removed from the platform, development ceased many years ago, and the functions will not be updated to support newer technology. For example, keying ARM based software will not and will never work. For those who have legacy software on older OS versions that still work with this feature, it is still available. We encourage not using it moving forward, and will not address any instances where it does not work on specific applications.

In addition to the standard method of managing programs and their respective software licenses, the Sassafras Software Platform also provides a "legacy" method that can sometimes* be used to secure programs against intentional software piracy.

The extra work of preparing and distributing a secured or “keyed” program variant is optional and completely unnecessary except when intentional piracy is a concern or as a means of uniquely tagging a particular executable file for KeyServer management.

When to use Keyed Control

The license management interface, usage tracking, license enforcement options, reports etc. for both standard and keyed program variants are essentially the same. However, on a computer where KeyAccess has been removed or disabled, a keyed program will not launch while an unkeyed program will. Also, when a client is not in the scope of any Manage policy, the launch of a keyed program cannot be Ignored or Observed – it will be Denied (unlike the unkeyed case).

The essential difference between an unmodified and a keyed version of a program is revealed when KeyAccess is absent, or when KeyServer has no policy which is applicable to the client. The unmodified version will simply run while the keyed version will not.

The keyed option may be useful in two cases:

  1. when you cannot guarantee that KeyAccess will remain installed and correctly configured on all the computers you intend to manage or
  2. when you need to easily distinguish (and secure?) “institutional copies” of software for KeyServer management (wherever they may be installed) while being sure to avoid interfering with personally owned copies.
  3. when distributing proprietary software (e.g. developed "in house") that you wish to prevent from being run without connecting to your KeyServer.

If none of these conditions applies in your situation, you should manage each program variant (i.e. "major version") in its unmodified form.

Maintenance update installers, routinely available from a publisher’s web site, make the “security” of keyed programs much less certain than in previous years! An update installer's job is to replace an old executable file version with a newer version. When applied to a keyed program, the updater may behave in one of five ways.
The updater may:
  1. transform the keyed program to the new version which remains keyed
  2. set the program free, transforming it to an unkeyed newer version
  3. transform the keyed program into a broken executable
  4. refuse to run, complaining that the original program is damaged or cannot be found
  5. post a message “Sassafras Keyed Binary found...contact your IT Administrator ...” (Adobe)

* Before relying on the keyed option for security or as a means of uniquely tagging a particular executable for KeyServer management, be sure to investigate item b) from the caution above – make sure that updaters won't transform it to an unkeyed version. Note: item e) from the caution above refers to the special behavior of several recent Adobe products whose installers recognize keyed software and can be customized to produce a keyed update (i.e. the updater is customized to produce the behavior listed in item e.

Example

KeyVerify is an example of a specially modified, “keyed”, program. Unlike a standard program (e.g., Calculator), it will not run if the KeyAccess client software is absent or not properly setup. Removing KeyAccess from a client computer will completely disable keyed programs – but any other managed programs (i.e. “unkeyed” programs) will be “set free”. In this sense, a keyed program is managed “securely” against software piracy. If you have other programs where this kind of security is required, you may consider transforming a copy of the standard executable file into a “keyed variant” which you can then distribute.

Key a Program

Select the Key a Program ... action from the File menu. Note that you must be using KeyConfigure on the platform of the program you are trying to Key.

A keyed program file cannot be unkeyed! Before transforming a program file into a keyed version always be sure the program installer is available so you can reconstruct the original or else be sure that you are transforming a duplicate copy and that the original is safely archived.

Once you proceed through the warnings, the Program Details for the program you keyed will appear. You will find the Keyed variant you just created at the bottom of the variant list, identified with the SS logo. When selected you will see in the upper right pane there are no associated Products. In order to control the Keyed variant, you will need to add it to a Product, that in turn is Managed by a Policy.



Standard Product Definitions from Sassafras Software will never include keyed variants. You may use the New Product Wizard to create new Product definition to include the keyed program. More typically, you may need to associate your keyed variant with a Product definition that already exists for its unkeyed counterpart. In this case, you can drag the Product from the Products Window into the Product Pane of the Program Details and save the change. We would recommend using the Family Product if you want to ensure that you are also controlling any unkeyed variants of the Program.