133 reputation
14
bio website
location Australia
age
visits member for 2 years, 8 months
seen Sep 26 at 4:55

Apr
4
awarded  Notable Question
Jan
28
awarded  Popular Question
Apr
10
comment HMAC/PBKDF2 vs Simple hashing algorithm for web service authentication?
Thanks for your comment. As I mentioned in another comment, this has certainly raised my interest in the crypto field in general. However, it has also raised more questions than it's answered. One of those being how to register new users along with their passwords through the service. That will be for another question, but it's timely as Jeff Atwood [had a great post] (codinghorror.com/blog/2012/04/speed-hashing.html) on that a couple of days ago.
Apr
10
awarded  Scholar
Apr
10
accepted HMAC/PBKDF2 vs Simple hashing algorithm for web service authentication?
Apr
10
comment HMAC/PBKDF2 vs Simple hashing algorithm for web service authentication?
Thanks for your updates. It has certainly provided food for thought. Given we'll be using SSL for all communications, I feel that I probably have overdone things with HMAC/PBKDF2. I also feel that given I've only been looking at this for a week or so, I am probably doing things incorrectly and hence spending a lot of time building something that isn't actually as secure as it ought to be. The past week has certainly sparked my interest in this crypto techniques though, and I'll be reading the links more thoroughly.
Apr
9
comment HMAC/PBKDF2 vs Simple hashing algorithm for web service authentication?
Can you elaborate on how HMAC can introduce the possibility of an attack? Especially in the case when it is used in conjunction with a nonce? I'm sure I'm missing something, but it seems to me that the use of a nonce with HMAC to both authenticate and ensure integrity of the request must be just as good (if not better) that just using a nonce on it's own. Again, if you've got any good references on the implementation of a nonce, then I'd appreciate seeing them. Thanks.
Apr
9
comment HMAC/PBKDF2 vs Simple hashing algorithm for web service authentication?
I appreciate your comments, but I have a few questions for you. From what I've read over the past week or so, it seems that PBKDF2/HMAC are commonly used for authentication/message integrity. Are you saying that this is misleading? Actually, often articles I've read suggest using HMAC in conjunction with a nonce. Signing requests in the flickr api is one. Also, are you aware of any good links describing the correct use of a nonce. I've not found any that are all that great thus far. Thanks again for your input.
Apr
9
comment HMAC/PBKDF2 vs Simple hashing algorithm for web service authentication?
I'm no expert as you can see from my question. However, I certainly don't advocate sending the password with each request, but a hash that is only to generate using the users password. My dilemma is the 'computationally expensive' part you mention. I don't want to make the app secure, but run like a dog. For the most part, I'm happy with HMAC/PBKDF in my situation other than the time taken to generate the 256 bit key. I'm not sure this is going to be more than the round trip introduced by a challenge/response scenario. I'll need to see the effect of the solution on the client I guess.
Apr
9
comment HMAC/PBKDF2 vs Simple hashing algorithm for web service authentication?
Thanks. I've was just reading about this in the link provided in the first paragraph of this answer. I'm not sure I totally follow the suggested approach sbown, but one thing that resonates with me in the article is the quote in the concluding paragraphs that states "...So yesterday's best practice might not be valid today.". This makes it all so difficult when I'm seeing so many varied opinions on what today's best practice is :) I think due to the trivial nature of this service, I'll likely opt for some easy to calculate MAC over HTTPS.
Apr
8
awarded  Student
Apr
8
asked HMAC/PBKDF2 vs Simple hashing algorithm for web service authentication?
Apr
8
awarded  Supporter