New answers tagged hmac
What matters is the respective abilities of Alice and Bob with regards to storage. In your case, you assume that neither Alice or Bob has any memory; they share a secret value (for HMAC), but they have not read-write slot to update. On the other hand, you also assume that Alice and Bob have clocks which are reasonably accurate (within a few minutes of each ...
AES is encryption; it is meant to maintain confidentiality. Encryption does not maintain integrity by itself: an attacker who can access encrypted data can modify the bytes, thereby impacting the cleartext data (though the encryption makes the task a bit harder for the attacker, it is not as infeasible as is often assumed). To get integrity, you need a MAC, ...
Viewstate is what you're looking for. It secures the page cryptographically, although it has known limitations that are located elsewhere on this site. An optional MAC should be enabled for sensitive pages, such as yours, that allows the client to post back prices that are used by the business layer.
Top 50 recent answers are included