RudeAuth 0.1.0

RudeAuth C# SDK

.NET client for a RudeAuth licensing server. The client embeds only an application id and an Ed25519 public key. Every response is signed and verified against that key before any field is trusted, so a patched binary cannot be talked into a forged "success".

Crypto is libsodium via NSec: Ed25519, X25519, HKDF, and XChaCha20-Poly1305.

Install

dotnet add package RudeAuth

Targets .NET Standard 2.1 and .NET 8, so it runs on .NET 5 and later, Unity 2021 and later, and Mono. .NET Framework caps at .NET Standard 2.0, which the crypto backend does not reach, so it is not yet supported.

Quick start

using RudeAuth;

// appId and publicKey come from `rudeauth-cli app create`. Both are safe to
// embed: the public key verifies responses, it cannot forge them.
using var client = new RudeAuthClient(appId, publicKey, "https://api.yourproduct.com");

Session sess;
try
{
    sess = client.Authenticate(userEnteredKey);
}
catch (RudeAuthException e) when (e.Code == ErrorCode.LicenseExpired)
{
    // expired is not device-limit is not banned; e.Code says which
    return;
}
using (sess)
{
    string offset = sess.Variable("offset"); // server-side, rotatable
    byte[] core = sess.File("core.dll");     // never shipped in your binary
}

Async equivalents (AuthenticateAsync, VariableAsync, FileAsync) are available.

No "is licensed" boolean, by design

There is deliberately no method returning a bool that means "is this user licensed". Authenticate returns a Session or throws a RudeAuthException, and the gating calls exist only on a Session, which cannot be built without a response signature that verified against the key you compiled in.

Errors

Every failure throws RudeAuthException; read its Code:

Network, BadResponse, SignatureInvalid, NonceMismatch, ClockSkew, LicenseInvalid, LicenseExpired, DeviceLimit, DeviceBlacklisted, RateLimited, SessionExpired, EndpointDisabled, AppDisabled, ResetUnavailable, FileNotFound, ServerError.

Behaviour worth knowing

• No offline mode, no cache. If the server is unreachable, calls fail. A cached "last known good" state is exactly what an attacker induces by blocking the network.
• A missed heartbeat is not a logout. The session retries until its TTL lapses. Dispose stops the heartbeat and zeroes the session key.
• Fewer than two readable hardware components and the SDK refuses to authenticate.
• Fingerprints are forgeable. Device binding deters casual licence sharing, nothing more.

Platforms

Hardware fingerprinting follows a shared per-OS component set: Windows (machine GUID, volume serial, CPU, BIOS, board), Linux (machine-id, DMI ids), macOS (IOPlatformUUID, serial).

Tests

The crypto is checked against known-answer vectors generated by the server's own code, and the protocol flow against an in-process handler that signs and seals exactly as the real server does.

dotnet test

License

MIT. The SDK holds only a public key; there is nothing in it to protect.