Why a 202-Character License Key Uses ECDSA P-256 Instead of Ed25519 or RSA
A developer needed to implement offline license key verification for a desktop application written in .NET. The license string had to work without an internet connection, contain no third-party dependencies, remain short enough for manual typing from an email, and support key rotation if the private key were ever compromised.
The first choice was Ed25519 because of its compact size, speed, and deterministic signatures. However, reflection over System.Security.Cryptography in both .NET 8.0.28 and .NET 10.0.9 showed that no Ed25519 or Curve25519 types are exposed. The only asymmetric primitives available are DSA, ECDsa, ECDiffieHellman, and RSA, together with the NIST P-256, P-384, P-521, and Brainpool named curves. Post-quantum algorithms such as ML-DSA and SLH-DSA appear only in .NET 10.
Attempts to create an Ed25519 curve with ECDsa.Create(ECCurve.CreateFromFriendlyName("Ed25519")) throw a PlatformNotSupportedException. An open GitHub issue requesting Ed25519 support has been open since 2015, with the approved API now scheduled for .NET 11.
Adding external libraries was considered next. BouncyCastle 2.6.2 adds a single 4.7 MB managed assembly, while NSec 24.4.0 brings a 92 KB wrapper plus native libsodium binaries. The latest NSec release refuses to install on .NET 8, illustrating the risk that a dependency’s platform support schedule may diverge from the application’s own lifecycle.
Benchmarks on an AMD Ryzen 7 5800H running .NET 8 Release showed the following verification times for a 39-byte payload: ECDSA P-256 at 191 µs, Ed25519 via BouncyCastle at 77 µs, and Ed25519 via NSec at 91 µs. RSA-2048 verification was fastest at 16 µs, yet its 256-byte signature expands to 571 Base32 characters—far too long for comfortable manual entry.
Encoding the 64-byte ECDSA signature plus payload in Base32 with groups of five characters separated by hyphens produces a 202-character key. This length is the shortest mathematically possible for an offline scheme that must embed both the license data and a cryptographically strong signature.
ECDSA signatures were recorded in IEEE P1363 format (r‖s) to guarantee a fixed 64-byte length; the DER format produces variable lengths between 69 and 72 bytes. The public key is stored inside the application as raw 64-byte coordinates rather than the full 91-byte SubjectPublicKeyInfo structure, reducing the embedded constant to 88 characters.
The chosen algorithm carries two acknowledged drawbacks. ECDSA signature generation depends on a high-quality random nonce; reuse or predictability can leak the private key. In addition, the same license data signed twice yields different strings, requiring the license registry to tolerate duplicates. These risks were accepted because signing occurs on a single offline machine using the operating system’s RNG, and the threat model is limited to protecting a commercial desktop application rather than high-value secrets.
Related articles
Building Your First Home Network Lab: Essential Tools and Experiments to Understand Corporate Networks
A cybersecurity professional without network knowledge resembles a guard without a building blueprint, spotting alarms but unable to trace the intruder. Setting up a personal lab on a standard computer bridges this gap through virtualization and hands-on practice with protocols and attacks. The guide recommends GNS3 for topology emulation, VirtualBox or VMware for running Windows and Linux workstations, Cisco Packet Tracer for quick simulations, Wireshark for traffic analysis, and draw.io for diagramming. Key experiments include configuring Cisco IOS routers with IP addressing, testing default gateways, observing ARP requests and replies, triggering broadcast storms via switch loops, and enabling STP to prevent loops. The lab demonstrates how legacy protocols like ARP expose networks to spoofing and why segmentation with VLANs and firewalls matters. Resources from CyberED provide demo access to courses on SOC analysis, penetration testing, and AI applications in security to extend learning.
PSLC and Agent-Ops: From Product Support to Infrastructure Transformation
Sergey Zhitinsky, founder of Git in Sky, attended the OPS Talk by Sber meetup on October 19 and discussed the PSLC methodology with architect Alexander Shapovalov. PSLC, or Product Service Lifecycle, outlines two loops for restoring services immediately and improving reliability to prevent recurrence through teams, knowledge, and platform support. Agent-Ops focuses on eight detailed steps for individual infrastructure tasks: intention, evidence collection, diagnostics, planning, approval, controlled change, verification, and lessons learned. The article illustrates their complementary use in a scenario where post-release log growth fills a database disk, requiring both service restoration and root-cause fixes. Both approaches emphasize knowledge retention, action control, and human accountability, though Agent-Ops v0.5.1 mandates explicit human approval and separate execution for production changes. PSLC suits larger organizations with shared platforms, while Agent-Ops targets smaller teams handling infrastructure operations with AI agents.
Russian Organizations Allocate 4.5 Trillion Rubles to Innovation Spending in 2025
Large and medium-sized Russian organizations directed a total of 4.5 trillion rubles toward innovation activities during 2025. Nearly half of the expenditure originated from the services sector, while information technology and telecommunications accounted for 860.9 billion rubles. The Institute for Statistical Studies and Economics of Knowledge at HSE University published the figures based on Rosstat data, showing an innovation intensity rate of 2.7 percent. Services companies alone contributed approximately 2.3 trillion rubles, including 882.7 billion rubles for research and development. Astra Group IR Director Vladislav Anshakov outlined major spending areas such as product development, cloud and AI hardware, and acquisitions of technologies and teams. The group expanded its portfolio with the Perseus DBMS and a 26 percent stake in AI developer AIB. More than one-third of organizations cited high costs and insufficient internal funds as key barriers to further innovation.
Telegram macOS Developer Says 99.9% of Client Code Is Now Written by AI and Suggests Firing Manual Coders
Mike, the developer of the official Telegram client for macOS, stated that artificial intelligence now generates 99.9 percent of the messenger's client code. He argued that programmers who continue writing code manually should be dismissed. In a Telegram discussion, Mike cited the gram.org website as an example created entirely with AI assistance in a single day, with domain support from Pavel Durov. He also described adapting the iOS client for a foldable iPhone Duo overnight using Claude. According to Mike, even designers are now contributing to client code, and 80 to 90 percent of Telegram developers share his positive view of AI tools. When participants raised questions about code quality and security, Mike replied that AI also identifies and fixes vulnerabilities, claiming the resulting code is superior to human-written equivalents. He further announced plans to open a new GitHub repository for the macOS client source code, as the previous repository had not been updated for over a year.