If you support Microsoft products that aren’t volume-licensed, chances are that somewhere you have a long list of the Microsoft product keys you use to install those products. This important list is extremely vulnerable to errors. You might have misread characters when you added the keys to the list. You might have read the key correctly but then mistyped or miswrote it. Or you might have trouble reading your list due to document age or bad handwriting. Product keys consist of 25 alphanumeric characters formatted in groups of five characters, which are separated by hyphens. Although I haven’t been able to find any documentation detailing which characters are used, it isn’t that difficult to determine. Based on my analysis of 160 product keys from 2002 forward, it looks like Microsoft uses the following 24 characters, which appear to be generated as truly random sequences:
Remembering this set is much easier if you look at the 12 unused characters out of the 36 possible alphanumeric symbols:
015 AEIOU LNSZ
The first set of characters is the numerals 0, 1, and 5. The reasons for avoiding them might be fairly obvious if you’ve dealt with lists of keys before: 0, 1, and 5 are all easy to confuse with various letters (e.g., the numeral 0 with the letter O), particularly when handwritten. The second set of unused characters—A, E, I, O, and U—are vowels. Although some of these can be confused with other characters, it seems more likely that these are eliminated intentionally to avoid producing sequences that look like words. Not using vowels doesn’t really enhance the security of a particular product key, but it does eliminate the possibility that a truly random key generation scheme will produce sequences that look offensive to particular users. The final set of unused characters—L, N, S, and Z—can be easily misread. A lowercase l can be misread as the numeral 1 or the uppercase I. A lowercase nn can be misread as a lowercase m. The letter S can be misread as a numeral 5, and the letter Z can be misread as the numeral 2. Now let’s talk about some of the basic common-sense tricks you can use to help keep your product key lists usable and safe. To make your product key lists usable, you should:
23w46789bhcdfgjkmpqrtwxy 23w4-6789b-hcdfg-jkmpq-rtwxyBoth are identical, except the first one doesn’t break down the product key into its five-character sets. There is no obvious way to determine where the problem is in the first example. In the second example, a quick inspection tells you that the first five-character sequence is missing a character, making it fairly easy to guess that the letter w might really be two consecutive Vs (vv).
After you’ve created your product key list, you need to make sure it’s securely stored. Because key use is tracked by Microsoft during activation, if your keys are accessible to people who misuse them, your products could eventually be impossible to activate during installation or patch updates. Here are a few points to consider: