Tagged Questions
2
votes
1answer
122 views
Web service HMAC authentication/anti-replay
I am creating a web service, which handles various requests from web clients. The client and server share a big secret key S, and when one part wants to send data, it calculates the token as follows:
...
1
vote
2answers
57 views
How to guarantee counter synchronisation between client and server for counter in hmac-based one time password implementation?
This is a clone of a question I posted on Stack Exchange. Thought I might catch the eye of some different people who could help here.
We are trying to implement a hmac-based one time password ...
2
votes
3answers
176 views
HMAC What is secure manner to distribute shared secret between client and server?
I am looking at ways to secure http communication using HMAC. My understanding is that in this scenario the client and the server both know a secret. This means the secret must be first generated on ...
5
votes
1answer
68 views
Authentication by Signing or MAC?
I'm still new to security, so I'm sorry if this question doesn't make sense or if I'm completely off base with something. I've got some messages I want to encrypt (probably with AES-256-CBC) and send ...
8
votes
1answer
259 views
When authenticating ciphertexts, what should be HMACed?
Some have argued for using AES-256-CTR with HMAC-SHA-256 for authenticated encryption over AEAD-specific modes like EAX and GCM.
However, when doing, this, what should be HMAC'd? And how? ...
6
votes
2answers
399 views
HMAC Based Request Signing - Storing the Salt
I'm working on a (non high security) project that currently isn't live but might go live at some point.
We have a REST API (implemented using Restlet and Neo4j) running on a server and an Android ...
5
votes
4answers
1k views
HMAC/PBKDF2 vs Simple hashing algorithm for web service authentication?
We are in the process of creating a web service and have been investigating ways of securing it. In reality, the service is likely to get very little traffic and the data is likely to be of little use ...
