Linked to: Encrypting a fixed format message?
I need to communicate from Site A, a set of information that will be presented to users of Site A, which when they choose to submit, should travel to my Site B. At Site B, I need to validate that the request indeed came from Site A.
Site A has a secret key that can be used for encryption.
The information that needs to be passed:
// The SiteName must somehow be identified to Site B otherwise
// I dont know which secret key to use for decryption
$SiteName = "SiteA";
$Command = "commandA";
$UserId = "42";
$UserName = "John";
$UserTimeZone ="America/New_York";
$UserCountryCode ="US"
$BookId ="966";
$message = encryptionfunction($SiteName.'-'.time());
Right now, i'm sending all of the above, visible to the user.
Should i be encrypting $Command and other fields and sending only
$SiteName = "SiteA";
$message = encryptionfunction($SiteName.'-'.$Command.'-'.$UserId.'-'.$UserName
.'-'.$UserTimeZone.'-'.$UserCountryCode.'-'.$BookId.'-'.time());
1.Edit
frm: https://stackoverflow.com/questions/5727607/generating-one-time-tokens-via-mcrypt-in-php
i will be providing api keys to my partner sites and they will be using code that i give them to to generate "tokens".
these tokens will be automatically present on forms which the partner sites' users will click on and reach my site. when they reach my site, i will need to validate that they indeed came from a partner site.
how do i validate this? the apikey will be secret, but what is presented in the form will NOT be, so it must not be possible for smart users to reverse engineer my algorithm.