I am trying to come up with a way to implement token-based authentication for a REST API without the need for SSL. The goal here is to avoid sending any sensitive information across the wire.
I was thinking of the following approach:
Step 1 - Client asks for request token from server and supplies a username.
Step 2 - Server returns user password salt & request timestamp.
Step 3 - Client then calculates password hash based on salt + actual password (captured via input)
Step 4 - Client then generates token by hashing password hash + request timestamp.
Step 5 - Client sends token & username & request timestamp to server
Step 6 - Server verifies authentication by re-generating same token with details provided.
From what I can tell nothing that isn't public already is going over the wire so packet sniffers would be out of luck. The token is hashed using the original password (essentially the secret key) so MitM are covered. Finally, the original timestamp from the initial request is sent back (and is part of the hash) therefore Replay attacks should be out of the question.
I have only started looking at security therefore pretty much a novice at this stuff so any help/advice would be appreciated!
I should have been more clear with regards to the SSL.... it's not that I am trying my best to avoid using SSL, it's more catering for the scenario where it isn't an option. Also, please target your answers more to the reasons why this approach wouldn't work & if it could be tweaked to work rather than "use SSL".