I'm trying to secure a REST API, our situation is that every client connecting to this API will also have a certificate signed by our own CA. Because of this, I think we can use the client certificate as an authentication mechanism, and install our root certificate on the webserver for verification and then use mutual authentication through HTTPS. We intend to do this with nginx so it's as simple as requiring nginx to have client verification on. However, I'm unclear about whether I should still timestamp and sign each request, should I still worry about message integrity and replay attack? Is there anything other attacks I should guard against?
2 Answers
As SSL ensures that the communication channel is secure from both tampering and snooping, there is no need to do more to ensure message replay and integrity.
This assumes that you are doing a secure authentication by validating the client cert, making sure it hasn't been revoked and isn't expired, is matched to the correct user, etc...
answered Feb 25, 2016 at 0:38
Yes, you can use the certs for mutual authentication. This would get you integrity checking, authentication, and encryption in transit for free, as long as the certificate is validated on each connection.
However, when you say protect against replay attacks, at the application level, you should still perform the necessary checks for replaying of messages.
