Supermicro Product Key Utility

This is a utility for encoding and decoding product keys that are used on Supermicro BMCs.

Inspired by Peter Kleissner's article about reverse engineering the original SFT-OOB-LIC key format.

Installation

This utility is a command line program. If Go is installed on your system, the latest version of this utility can be built and installed by running:

go install github.com/zsrv/supermicro-product-key@latest

Otherwise, a binary can be downloaded from the releases page.

Usage

Execute the binary without any arguments to see usage instructions. Reading this entire README is recommended.

Key activation instructions can be found at the Supermicro website (PDF version).

Quick Start

All key types are bound to the MAC address of the BMC LAN port. Replace 3cecef123456 in the following examples with the BMC MAC address of the system you plan to activate the key on.

OOB Keys

Encode a new key:

$ ./supermicro-product-key oob encode 3cecef123456
CE27-F641-9B04-6B24-5D04-5D32

Find the MAC address associated with a key:

$ ./supermicro-product-key oob bruteforce CE27-F641-9B04-6B24-5D04-5D32
searching for mac address ...
found match! mac = '3CECEF123456'

Non-JSON Keys

List all key types that are available:

$ ./supermicro-product-key nonjson listswid
License SKU         Display Name      ID
-----------         ------------      --
                    Reserved          0
                    SSM               1
                    SD5               2
SFT-SUM-LIC         SUM               3
SFT-SPM-LIC         SPM               4
SFT-SCM-LIC         SCM               5
SFT-DCMS-SINGLE     ALL               6
SFT-DCMS-SITE       SITE              7
SFT-DCMS-CALL-HOME  DCMS-CALL-HOME    8
SFT-DCMS-SVC-KEY    SFT-DCMS-SVC-KEY  9
SFT-SDDC-SINGLE     SFT-SDDC-SINGLE   210

Encode a key with no expiration date, and safe default values for the remaining attributes (recommended). Replace SFT-DCMS-SINGLE with any other SKU from the list above to encode a different key type:

$ ./supermicro-product-key nonjson encode --sku SFT-DCMS-SINGLE 3cecef123456
AAYAAAAAAAAAAAAAAAAAAExLCU/N0RxxvG7ZACnE9iz3GCd/is0BF+s/dgeUoIyPgnp3qBgf5iyrcpByGPE9xgkT38mRmt2/R+3S/iXb/8ram5O/cXUJxvkmqZi0ODYUbze7+NLgSZ/YPPM77OBGXTgiLGYq4pihruPxfYLkT64U1vfZQLCJWBwoinbMbdxTlBC9we54hWXSF5vcY9MGNiJsZ+d3vKdoSMgCqSqHNCRLRYlYVjrT4CYmtw2k6qcBvM3Zq0pLwjznsP3tD7CxHKIf5DoIph6zj9M3VTtiPm2yzgJOSJwNGhFJq4bvErw2PqqGURub+lNz5AazeafiRw==

For experimentation purposes: Encode a key with all attributes specified (attributes that are omitted will be left at their default values):

$ ./supermicro-product-key nonjson encode --sku SFT-DCMS-SINGLE --software-version ABC123 --invoice-number 0123456789 --creation-date 2020-12-30T12:00:00Z --expiration-date 1970-01-01T00:00:00Z --property 01AA02FF 3cecef123456
AAYAAAAAAAAAAAAAAAAAAJOVA97uSfqDCtInPd8H2g4rUdY5PtJ3op7hUYaFWOn2aWeT/f+4ZaMdelxJgFG3NjRPqXIMfJ2mFdeR8tZYfNusG3i6SP7cDBsN5Kbu/Bfj3q6WWlUKavF9j6oulmnvS83CZkzEdjQrOfq7bokHV6HnAUn/83UGKn+b5Db4E7fcGjmHYOCzP9rTTZnmtfUHShcEN48+Aka9ACcyfUDo9kdiJQpFRzTQz0ay5gGii6MB0Yw+G1JECp804aNGzCzl5PsP122dZ0cTFFN7THfy07Se1NDd+GCCoH2AN7UFa8tTKquZBgdwBgU/EOPX31YXJQ==

Decode a key:

$ ./supermicro-product-key nonjson decode 3cecef123456 AAYAAAAAAAAAAAAAAAAAAJOVA97uSfqDCtInPd8H2g4rUdY5PtJ3op7hUYaFWOn2aWeT/f+4ZaMdelxJgFG3NjRPqXIMfJ2mFdeR8tZYfNusG3i6SP7cDBsN5Kbu/Bfj3q6WWlUKavF9j6oulmnvS83CZkzEdjQrOfq7bokHV6HnAUn/83UGKn+b5Db4E7fcGjmHYOCzP9rTTZnmtfUHShcEN48+Aka9ACcyfUDo9kdiJQpFRzTQz0ay5gGii6MB0Yw+G1JECp804aNGzCzl5PsP122dZ0cTFFN7THfy07Se1NDd+GCCoH2AN7UFa8tTKquZBgdwBgU/EOPX31YXJQ==
{
        "FormatVersion": 0,
        "SoftwareIdentifier": {
                "SKU": "SFT-DCMS-SINGLE",
                "DisplayName": "ALL",
                "ID": 6
        },
        "SoftwareVersion": "ABC123",
        "InvoiceNumber": "0123456789",
        "CreationDate": "2020-12-30T12:00:00Z",
        "ExpirationDate": "1970-01-01T00:00:00Z",
        "Property": "AaoC/w==",
        "SecretData": "MjdiOGUzYWFmN2NlZGU0MzNjNWUzYjUzZjU5YzJhOWI=",
        "Checksum": 24
}

Find the MAC address associated with a key:

$ ./supermicro-product-key nonjson bruteforce AAYAAAAAAAAAAAAAAAAAAJOVA97uSfqDCtInPd8H2g4rUdY5PtJ3op7hUYaFWOn2aWeT/f+4ZaMdelxJgFG3NjRPqXIMfJ2mFdeR8tZYfNusG3i6SP7cDBsN5Kbu/Bfj3q6WWlUKavF9j6oulmnvS83CZkzEdjQrOfq7bokHV6HnAUn/83UGKn+b5Db4E7fcGjmHYOCzP9rTTZnmtfUHShcEN48+Aka9ACcyfUDo9kdiJQpFRzTQz0ay5gGii6MB0Yw+G1JECp804aNGzCzl5PsP122dZ0cTFFN7THfy07Se1NDd+GCCoH2AN7UFa8tTKquZBgdwBgU/EOPX31YXJQ==
searching for mac address ...
found match! mac = '3CECEF123456'

JSON Keys

Verify the signature of a product key:

$ ./supermicro-product-key json verify ac1f6b3ddaec '{"ProductKey":{"Node":{"LicenseID":"1","LicenseName":"SFT-OOB-LIC","CreateDate":"20200921"},"Signature":"OAaLKLy5IEK9WnIdnyA9ew89qTKQrm1eu+Q84CbwjR7XG7JGYccec+3vS3y/kQRRej3DcNVQPWsasX86ROTT+LZFsNY2mIEbQ6+Y/Tmv6+jwYgbQjEN6CjI7ahyKcebN12+3cLvPZyRf3kDqgtcpfuw3Qeg8BbhhyHQk29yNp+NG0XbKn02sHTrskvAGgG0GGlDCT5YmNa0gDSMzsvt/eH9nskb5opQNE3j7MAMXbjpI7xVHRbmB2N5iSu8gQUj0/pmk615ztM/uB54ur3GninJRU74S9Kotz+JunJg4pprGyQW544ggmzklmtr3zCA3GK/d929eZsVk5p8UxXG7wQ=="}}'
signature verified ok

Find the MAC address associated with a key:

$ ./supermicro-product-key json bruteforce '{"ProductKey":{"Node":{"LicenseID":"1","LicenseName":"SFT-OOB-LIC","CreateDate":"20200921"},"Signature":"OAaLKLy5IEK9WnIdnyA9ew89qTKQrm1eu+Q84CbwjR7XG7JGYccec+3vS3y/kQRRej3DcNVQPWsasX86ROTT+LZFsNY2mIEbQ6+Y/Tmv6+jwYgbQjEN6CjI7ahyKcebN12+3cLvPZyRf3kDqgtcpfuw3Qeg8BbhhyHQk29yNp+NG0XbKn02sHTrskvAGgG0GGlDCT5YmNa0gDSMzsvt/eH9nskb5opQNE3j7MAMXbjpI7xVHRbmB2N5iSu8gQUj0/pmk615ztM/uB54ur3GninJRU74S9Kotz+JunJg4pprGyQW544ggmzklmtr3zCA3GK/d929eZsVk5p8UxXG7wQ=="}}'
searching for mac address ...
found match! mac = 'AC1F6B3DDAEC'

List all key types that are available:

$ ./supermicro-product-key json listswid
License SKU       ID
-----------       --
SFT-OOB-LIC       1
SFT-DCMS-SINGLE   2
SFT-SPM-LIC       3
SFT-DCMS-SVC-KEY  4
SFT-SDDC-SINGLE   5

Product Key Formats and SKUs

This section describes each product key format, and each license SKU that is supported by each format.

OOB

A 24-character hex string split into groups of 4 characters, separated by dashes.

Keys in this format are created using the MAC address of the BMC that the key will be activated on as input.

SFT-OOB-LIC

Used by 11th generation and earlier platforms. This key is delivered in the JSON key format for 12th generation platforms.

Enables various out-of-band (OOB) management features.

The functionality provided by this key is included in SFT-DCMS-SINGLE.

Non-JSON

A 344-character base64-encoded string.

Keys in this format are encrypted and decrypted using the MAC address of the BMC that the key will be activated on as