Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm designing a web-based notification framework (i.e. a user can subscribe to updates from a service or another user) where communication between users is encrypted.

User-to-user communication on the web requires a server to act as a relay - the twist is that I'm running on the assumption that the server itself is compromised (although the clients are still secure).

I believe I've designed a set-up that means the worst a server can do is analyse message sizes and IP addresses, or drop notifications. That is, even a malicious server can't read the actual content of the notification.

Bundled along with the notification system is a way to provide secrets for use with existing APIs. So you might present a basic profile on the web (as an API), and I "subscribe" to your profile (signed with my public key, etc.) and one of the first messages I get through my notification stream is a set of secrets that I hash/sign my requests to your API with in the hopes of getting extra content.

So my question is: are there existing techniques (or even standards!) for this kind of thing, preferably JSON-based? Before I try and get feedback on my wild plan, I'd like to know whether there's an existing setup I can either use or imitate.

share|improve this question
I don't have time to research it, but I'd think there could be a sort of SAML ticketing mechanism you could use here. SAML isn't necessarily made for this use case, but the basic idea of assertions should work for your purposes. – bethlakshmi Oct 4 '13 at 19:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.