Tag Info

New answers tagged

0

On second thought - a great way to authenticate an API that exposes your systems' functionality to partners is OAUTH2 - what is terrific about OAUTH2 is that you have a good choice of libraries, and you can use a flow that fits your user relationship - server flow, web browser flow, mobile flow, password flow without changing your underlying API business ...


4

It is not clear for me which kind of problem you are trying to solve and it might not even be clear to you. If you have a clear idea what you are trying to achieve with the authentication than you would not need to offer the client multiple authentication schemes but stick with the one which solves your problem. If you fear a compromise of the ...


4

Well curl with basic authentication is acceptable - remember thought that the syntax is curl --user name:password https://yoursite.com and this means that you will have to hard code credentials in the code that invokes your REST API - typically if it's Ajax - then we're talking client side code and that means exposing credentials in the browser (or in a ...


2

I've written simple python3 script to illustrate: from hashlib import sha256 opad = bytes(0x5c for i in range(64)) ipad = bytes(0x36 for i in range(64)) print(sha256(opad + sha256(ipad).digest()).hexdigest()) The output is identical to the string you seen on wiki. I've checked and I can confirm that your results can be obtained if we concatenate opad ...


2

I've added my answer here as I feel the existing ones don't directly address your question enough for my liking. Let's look at RFC 4868 (regarding IPSec, however it covers the HMAC-SHA256 function you intend to use - em mine): Block size: the size of the data block the underlying hash algorithm operates upon. For SHA-256, this is 512 bits, for ...


0

John The Ripper seems to welcome external contribution especially through their "Jumbo" aka "community enhanced" version of the software instead of the mainstream one. It is described as having a lower quality standard, but easier for patch integration allowing more people to integrate new modules in a more convenient way which, I think, is precisely what ...


3

The RFC 2104 defining HMAC functions answers this question: The key for HMAC can be of any length (keys longer than B bytes are first hashed using H). However, less than L bytes is strongly discouraged as it would decrease the security strength of the function. Keys longer than L bytes are acceptable but the extra length would not ...


1

EDIT: Wrong answer. Left undeleted to preserve comments thread. HMAC user-input keys that are longer than the specific hash algorithms blocksize are first shortened. (By running the long keys through the hash. And then using that hash as the actual key.) SHA256 outputs 256 bit hashes. That's 32 bytes. So I suggest you generate 256 bit HMAC secret keys. ...



Top 50 recent answers are included