I am creating a web service, which handles various requests from web clients. The client and server share a big secret key S, and when one part wants to send data, it calculates the token as follows: ...
How to guarantee counter synchronisation between client and server for counter in hmac-based one time password implementation?
This is a clone of a question I posted on Stack Exchange. Thought I might catch the eye of some different people who could help here. We are trying to implement a hmac-based one time password ...
I am looking at ways to secure http communication using HMAC. My understanding is that in this scenario the client and the server both know a secret. This means the secret must be first generated on ...
I'm still new to security, so I'm sorry if this question doesn't make sense or if I'm completely off base with something. I've got some messages I want to encrypt (probably with AES-256-CBC) and send ...
Some have argued for using AES-256-CTR with HMAC-SHA-256 for authenticated encryption over AEAD-specific modes like EAX and GCM. However, when doing, this, what should be HMAC'd? And how? ...
I'm working on a (non high security) project that currently isn't live but might go live at some point. We have a REST API (implemented using Restlet and Neo4j) running on a server and an Android ...
We are in the process of creating a web service and have been investigating ways of securing it. In reality, the service is likely to get very little traffic and the data is likely to be of little use ...