I'm working on authentication for my JSON-RPC API and my current working strategy is using signed requests sent via POST over SSL. I'm wondering if anyone can see any vulnerabilities that I haven't ...
I have a device which should lock and unlock something after receiving a signed server response. So in the best case a loop would lock like this: User locks device User wants to unlock device User ...
I am going to protect an image file (ancient manuscript) which will be available online for everyone to download. I want to protect the file in these situations: When it's on the server, I need to ...
I'm in the process of implementing a public API for my web service. Security is a key concern as money is involved. It seems the current common practice for "authenticating" users in API requests is ...
Say we have a system with strong shared keys (not passphrases), and we're trying to sign messages sent by the server that will be visible to an attacker. E.g. storing session state in a signed cookie. ...
I have a secret key k and message m. I send m || HMAC(m, k) to some other party, who can verify the integrity of m, assuming that they know k. Suppose I have multiple messages m1, m2, and so on. ...