Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Following is my understanding - A third party app redirects to a an OP for authentication. Once the authentication is complete the OP redirects back to the third party app.

It also sends back in query string a number of parameters and also sends back a signature. My question is how does the third party app verify the signature. As I understand it will need a shared key to do this, but I don't see that shared in the in the initial redirect to the OP?

Now assuming that a key was shared, then what is the use, as the communication can be sniffed, and the contents manipulated.

share|improve this question

migrated from Jul 24 '12 at 11:58

This question came from our site for professional and enthusiast programmers.

up vote 1 down vote accepted

According to the openid spec, a shared key is (optionally) established between the OP and the Relying Party using a Diffie-Hellman Key Exchange

Diffie-Hellman is one of the key agreement protocols which allow for two parties to establish a secret key without a third party knowing what that key is.

The Relying Party verifies the information received from the OP including checking the Return URL, verifying the discovered information, checking the nonce, and verifying the signature by using either the shared key established during the association or by sending a direct request to the OP.

If the shared key is trustworthy, any contents modified should fail signature verification. This verification is done by the Relay Party, or web application looking to verify OpenID credentials.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.