How to deliver a java program to a client?

Question

I wrote a software application in Java. Now I want to deliver it to my clients. But before that, I want to do something on that software which are mentioned below. You can answer any or all of the below questions:

I want to:

1. Encrypt all the .class files so that no one can decompile it. How can I encrypt it?
2. After encryption I want to obfuscate that code to add extra safety. How can I do that?
3. Add some "serial-key" functionality so that the software works only after registering it with the key provided by me. This is very important so as to prevent multi-user usage of my software. How can I add that key functionality and how can I generate keys. And how can I restrict that software to work only on a single computer.
4. The jar file can be unzipped and the .class file can be seen. Is there any way to wrap jar file into something so that no one can unzip that file.
5. I don't want to tell the client to first install java to run my application. So is there any way by which if anyone installs my software, the java automatically gets installed on his/her computer without informing him that java is being installed to his computer. If it is possible, then Is it legal to use Java software in this way.
6. Change the icon of the jar file permanently.
7. Implement a code which checks my site for any available updates.

If you want any other suggestions to increase the security of the softwre, then you are welcomed too.

Answer 1

In no particular order:

2 - There are products that perform obfuscation. They typically rename classes / variables / methods to single letter names. This makes determining user reported errors rather difficult. Stack traces showing the exception occurs in a.b.c are not particularly helpful.

1,3,4 - You can't fully avoid this risk if your are distributing java. Your code needs to be unpacked and loaded at some point. If someone replaces rt.jar in the jvm then they can replace the top-level class loader and dump out your classes like that. Obfuscation makes this less useful for them, but see the above caveat.

5 - Distribute a "private jre". Basically, you have a jre in your program folder. Your launcher script runs it. Increases the size of your distribution though.

6 - On windows, this would be a file association issue. But that would also affect all other jar files. Unless as part of 4 (however you manage that) you also use a different extension. Not sure about other operating systems.

7 - Use Java Web Start? Failing that, just have a file on your server listing the most recent version, fetch the file and compare with the installed version.

For 1,2,4 and 5 you could also look into compiling to native code using gcj or similar. Beware of compatibility issues if you do that though.

Answer 2

Encrypt all the .class files so that no one can decompile it. How can I encrypt it?

You can't. If no one can decompile it, how do you expect the target JVM to?

After encryption I want to obfuscate that code to add extra safety. How can I do that?

I want to add some "serial-key" functionality so that the software works only after registering it with the key provided by me. This is very important so as to prevent multi-user usage of my software. How can I add that key functionality and how can I generate keys. And how can I restrict that software to work only on a single computer.

There are a couple of ways to do this but a simple one is with public key cryptography:

• Your software generates a random request ID or a request ID based on the machine attributes and your user submits this to you.
• You sign the request ID with your private key and send it back to the user.
• The user provides the signed request ID to the software which validates that it was signed by you.

The jar file can be unzipped and the .class file can be seen. Is there any way to wrap jar file into something so that no one can unzip that file.

No

I don't want to tell the client to first install java to run my application. So is there any way by which if anyone installs my software, the java automatically gets installed on his/her computer without informing him that java is being downloaded to his computer. If it is possible, then Is it legal to use Java software in this way.

Try building an NSIS installer for your application that detects/installs Java and your program.