I think the key generators are owned by the developers and companies and then the stores buy the keys in bulk from them, because they run out of keys frequently and ask the developers for more.
When you activate your key on the steam client it does a check against a database which stores the previously generated keys by the developers.
Comment has been collapsed.
"When you buy a key from a site and it says it's "retrieving your key now" what exactly is happening?"
What site does this? From most of the sites I buy, the only thing that takes time is usually authenticating payment, I've never noticed a delay for key retrieval, if you mean when you click the Steam button to reveal a key on a site like Humble, they are just grabbing a key from their own database (given to them presumably by the publisher/developer of that game, which was in turn given to that publisher/developer by Valve, I do believe).
"Is it something mathematically generated that adheres to some type of complex algorithm?"
Third-party sites don't create the keys, at least I've never been led to believe that from what I've seen developers say here or there in the past.
"Similarly, when I redeem a key on Steam, what is actually going on? Does Steam have a master list of all unique valid keys for all games?"
I'm not sure the exact details, sorry, but they have to have someway to track every single key ever generated (track whether it's used or unused), whether they actually have to store that data 1:1 or if they have a more clever scheme to do so is beyond me. I would guess the former at any rate.
"Or is there some third party database somewhere that Steam has to cross-reference with to validate validity of key and which game? Or is there some algorithmic relationship between a purchased key and a separate validation key that Steam?"
These are Steam keys, I don't see why they would have to cross-reference another companies database to check them :P
Comment has been collapsed.
Please, use the code format to quote, or at least some " " D:
To use code format use the ``` before and after the phraseEdit:
Or the official format for quoting.
>I'm quotingI'm quoting
Comment has been collapsed.
Not sure if this is actually how it works, but for Steam I believe the Publisher requests X amount of keys from Steam for their game, which Steam delivers. They then sell the keys to resellers as they see fit. The resellers buy X amount of codes (which is why they can run out). Everyone is pulling out of their own little key database. Then the consumer activates the key on Steam which they verify against their generated list.
Comment has been collapsed.
Ahh. That's interesting, so the publisher may not be involved with the key generation - handing that responsibility off to Steam.
Comment has been collapsed.
Steam generates all "Steam keys" (hence the word steam in the name) If it's a game that you can activate in steam with a product key from the physical CD then that is not a key created by valve
Comment has been collapsed.
No, I'm almost sure Steam provides the developers/publishers a key generation toolkit.
Comment has been collapsed.
Right, Steam just generates keys as the publisher requests them.
The only question I have about the process is for 'stolen' keys, like in the Devolver Digital incident: https://twitter.com/devolverdigital/status/466577590606520320
I suspect either someone hacked someone with key access at Devolver, or compromised their Steam Publisher account, or something, to get those keys, which Devolver then revoked.
Comment has been collapsed.
The Devolver Digital keys weren't stolen, just not legitimate. Most likely they were bundle keys being resold by G2A.
"Stolen" keys often come from purchases made with stolen credit cards or stealing actual physical copies of games that come with a steam code.
Comment has been collapsed.
That certainly happens but I don't think it is always the case. I think at least some publishers/developers have the ability to generate their own keys although I don't know how common that is (especially for smaller publishers) and I'd guess it involves software/systems provided by Steam. And I'm pretty sure a variety of keys distributed with physical copies that can be activated on Steam are not generated by Steam.
Comment has been collapsed.
"When you buy a key from a site and it says it's "retrieving your key now" what exactly is happening?
What site does this? "
(edited, thanks for the formatting tip)
I was referring to humble's site where they do that. It has something where you click a button to retrieve your key like you mention.
Comment has been collapsed.
Humble bundle retrieves the key from their own database after buying several keys from the publisher. For example, a couple of days ago they ran out of keys from their Telltale bundle promo.
Comment has been collapsed.
Comment has been collapsed.
If you're talking about the message after you make a purchase, that's just Humble processing your order and assigning you your keys.
Comment has been collapsed.
Steam generates the keys, not the developers.
For security reasons, I highly doubt there is a database sitting somewhere at Valve HQ with a straight list of keys and their corresponding games. At the very least, I am sure the key is transformed with some algorithm first before it can be validated. After all whichever algorithm is used to generate the keys in the first place must necessarily never generate the same key twice, for the same game or different games.
Comment has been collapsed.
Why so? If there would be just an algorithm stand behind, crackers could setup a dev account at steam and generate a few million keys and have enough data to analyse how this fictive algorithm would work. Then they could devise a general purpose keygen for Steam.
No way Valve would be that stupid to rely just on security by obscurity. Especially with so many parties working with their backend. Any "secret" given to the public might be cracked.
The real way is to withhold those secrets "keys" and store it in secure databases located in the cloud. Running on a good infrastructure. With front servers getting information out and in and with database servers which are not connected directly into the net but through segregated networks. If that ever gets breached - keys might get leaked, created, removed even.
Comment has been collapsed.
No, what I am saying is that the key is likely transformed before it is validated. As in, there is still a database to validate against. But there's no way it is as straightforward as just plugging the key in and searching the DB for the key.
Comment has been collapsed.
But thats what they most likely will do. Why adding another coding stage? Surely they could do... but its entirely pointless. There is no additional secret involved. Only adding another secret to the sauce would add to more security but that is entirely unnecessary. And whom should they try to hide from... the server or network admins ? Thats the only peeps that could access those databases
Comment has been collapsed.
Keys are probably stored hashed. This way, even if someone gets unauthorized (or authorized but with bad intentions) access to the database he can't know the keys.
Comment has been collapsed.
Alright that makes sense. This wouldn't stop a willing a possible disloyal admin or cracker but slow down any progress as keys need to be cracked too... but if crackers could access the key databases - i wonder if it wouldn't be far more attractive to access the steam account databases or the payment databases... cc data always comes in handy :)
Comment has been collapsed.
Mostly guesswork here, but should be very close to it:
- Steam has an API for the devs to allow to create arbritray amount of keys -> possibly as part of the steam webpages but might be a standalone app with connection to steam servers
- Those keys are stored in the databases of Steam - along which appid they belong to
- Fetched keys can then be distributed at will (at any cost they like even free)
- When redeemed the account gets the game id added, the key is removed from database
- I believe there is no charge or cost involved for creating, accessing, distributing or redeeming keys neigther there is for downloading game data or using the steam cloud services, essentially keys are plain database entries which are created or removed, accounts get gameid's added or removed too
- if an account has the appid attached he can ask for a download which he'll get - again through some api
- steam keys are absolutely unlike offline keys that were used before the steam & co
- those keys used were generated using algorithms which encoded the name of the licensee or other information
- keygen's reversed that process allowing to create fitting pairs of name & serial - the original dev created one for himself ... but cracker groups often did their own analysis of the serial activation code and wrote their own
- offline keys relied on the intransparency of the algorithm devised to code the information eigther to the correct name or to contain the information "valid license"
- online keys rely on the integrity of the databases, e.g. in their cloud
No magic involved. Actually its pretty boring gruntwork. I hope i didn't bore you :)
Comment has been collapsed.
The key is not removed from Steam's database because a publisher can request Steam to remove thousands of licenses from a particular game at once only sending them the list of keys they want to void. So every single game on our account is attached to a key present on steam DB.
I agree with the rest of your points, developers can generate almost infinite amount of keys with some kind of key generator provided by Steam. I think it simply generates a random (unused) key, checks it against a secure Steam DB on the cloud to associate the key with the appid and finally adds an entry on Steam DB.
Comment has been collapsed.
if we knew we could make the keys oursefls xd, must be an ecripted key, that once test with the proper decription "key" on the software provider servers give a valid or invalid answer.
Comment has been collapsed.
Keys are made out of pure random gibberish so to speak :)
Surely you can create tons of more gibberish and test the steam activiation servers with. But the chance to randomly hit a actually stored key is superslim. And likely won't go undetected for long.
No as long as they are in control of their servers there is no chance ;)
Comment has been collapsed.
That probably explains why we have a limited number of activations each hour, somebody could create a powerful script or online keygen to test every single key with that format and activate several unredeemed keys.
Comment has been collapsed.
Yeah and even worse there is no key checker api - everyone is yearning for. You need to be logged in and do the activation. After long years steam key managment gets really really tedious without.
Comment has been collapsed.
Yes, a key checker could be easily abused if allows an unlimited number of checkings. You can easily create a script to test every steam key and it will give you a list of all unredeemed keys on Steam database :D
Comment has been collapsed.
There is a fair bit of entropy in 36^15 though (A-Z, 0-9). If you were to guess that there were a trillion valid Steam keys, only 1 in ~220 billion would be valid (and a subset of that unredeemed).
Comment has been collapsed.
That's why I used the word "powerful". It could be possible to do if there were no limited checkings against their database. You only need good hardware or even distributed computing, depending on your impatience. It is only a script trying all combinations against a database, no calculations involved.
Comment has been collapsed.
You could have a botnet of millions of machines, but there's only so many queries the key servers can perform a second and so many TCP connections or packets the server can take. A very small packet, say about 50 bytes, would saturate a 10 gigabit line at ~26.8 million packets per second. If TCP-based then three packets would be needed just to establish the connection, then at least two for the request and reply, then four to close the connection gracefully, less you leave the connection half-open and exhausts the server's ports. That gives you at worst, about 3 million attempts per second per server, or about a day to find a single valid key.
Brute force becomes very troublesome when you get the internet involved.
Comment has been collapsed.
Well, if your calculations are correct then it's not worth the effort even if Steam allowed unlimited connections to their activation servers. It seems a pretty secure system.
Comment has been collapsed.
its even worse... its a-z,A-Z,0-9 ... so space is 62^15 possible combinations ... thats 768,x * 10^24 :)
Comment has been collapsed.
TL;DR version
Steam is responsible for key generation. There's no specific algorithm, I mean there is one but it consists of random data to make sure that no other service/user/server can generate the same key using the same way.
Developer of the game can (optionally) generate as much keys as he wants for particular game. Steam is responsible for generating them, so developer can only send a request to generate key(s) for game X and receive them directly from steam through secured connection. Now most of the sites such as humblebundle, IG etc. do not keep unused keys in the database, rather they contact Steam network with key generation request once you click the button. This received key is then saved in the database. But of course, they can also ask for such key at the time of buying the bundle by you, and just "unhide" it later for you when you request. It's up to site implementation.
Comment has been collapsed.
Interesting, out of curiosity, are you a developer/publisher?
My only question is: why resellers (Humble Bundle included) run out of keys frequently if they have direct contact with Steam network for infinite key generation at request?
Comment has been collapsed.
Because HB is not authorized to issue unlimited number of keys, as they're NOT developers. They ask proper developers (or publishers) for X amount of keys they can store and distribute to users.
I'm not steam game developer, neither publisher, but I work with steam network and steam protocols, so I know a bit.
Comment has been collapsed.
Groupees for instance even pays devs in advance for those x keys. So its like they buy them in bulk beforehand and sell them single to users. x might be anything between 500 to 50000 keys.
Comment has been collapsed.
Related, I've always wondered if it was "safer" somehow to wait to generate the key for a bundle game until you are ready to use it (activate or trade), as opposed to simply getting all of the keys as soon as you buy the bundle. It seems like once the key is generated, it can be stolen (or lost, or I suppose guessed via brute force-- unlikely). But if I wait until I need the key, then they will always generate me a "fresh" key.
Of course, in some cases, they just give you a plateful of keys whether you're ready for them or not. =)
Comment has been collapsed.
It depends. Not generated key for you does not mean that key wasn't pre-genereated waiting for you, read my response above for details.
As I always like to say, if somebody brute-forced HB or Steam, they would have better things to do than stealing steam keys for bundle games, trust me.
But of course, if you assume that your website indeed generates steam key after being asked to do so, it is "safer", but it does not mean that generating them right away is unsafe either.
Comment has been collapsed.
Thank you. =) Of course, by not generating, that also means that I can't lose it! =)
Comment has been collapsed.
I don't work for Valve nor any major game publisher, but I am a software engineer that has experience working on projects involving web store for software license keys as well as the activation of the software itself.
Generally, even us software engineers don't know how to generate the key itself, the "keygen" is controlled by our senior technical manager. Our key format goes something around 30+ digits alphanuric, with some dashes in between. We don't have a database of keys, because all our keys are generated real-time. That is, the web store will call a web service, passing a number of parameters (including machine ID, current date time, the license type like basic/premium/enterprise, and more), and the web service will return a valid key to the user. The web store don't store the key itself as to not run into the risk of a key leak. The key generated are kinda like a combination of encode/encryption.
We do have a reseller web front too that can bulk-generate keys for resellers to use. These keys have a reseller ID and batch ID tied to one of the parameters in the encryption.These resellers are the one that bulk-generate a list of keys and they will store it somewhere. So in an event of a key leak, most likely are the reseller's database got compromised.
As for license activation, the PC in use must be online. When the user activate a license key, the software itself will try to decrypt the key and match with some of the matchable settings like software version and machine ID. Then it will check the validity of the key online via another web service call to one of our "activation server". This is where we can control leaked keys, so in the event of a leaked keys, we can fail the activation at this step when we detected that a certain reseller ID and batch ID are reported leaked.
Comment has been collapsed.
I've done a few google searches on this but can't find satisfactory answer. I was thinking about software keys, and have a technical question for programmers or others who may know how this works.
Essentially, how does a software key work for activation? The nuts and bolts of what is happening when a key is bought and redeemed.
Example: When you buy a key from a site and it says it's "retrieving your key now" what exactly is happening? Is it simply pulling up a list of valid keys that have been pre-purchased? Or is it connecting with a central database somewhere and pulling a key off of a stack in real time? Is it something mathematically generated that adheres to some type of complex algorithm? Or if I buy from humble bundle, are they calling Steam in real time and securing a valid key, and then I turn around and give that key back to Steam? Or?
Similarly, when I redeem a key on Steam, what is actually going on? Does Steam have a master list of all unique valid keys for all games? Or is there some third party database somewhere that Steam has to cross-reference with to validate validity of key and which game? Or is there some algorithmic relationship between a purchased key and a separate validation key that Steam?
Anyhow, I'm kindof curious how this works if there's anyone here with insight I'd appreciate.
Comment has been collapsed.