I have a situation where I need a token that provides authentication. The common HMAC procedure I found is:

  1. Get Some key using login credentials
  2. Create Message, append key and other message data (in defined order)
  3. Hash with a Secret Key
  4. Transmit message, and include values that are in the message (not hashed)


  1. Receive the message
  2. Use the unhashed values to rebuild the message
  3. Hash with secret key
  4. If the hashes match, then the message is good.

I am implementing something similar - but I don't think I need to do some of these steps. I wanted to Know: Does my implementation have security holes in the logic?

My Implementation:

  1. Client asks the server to generate a Token - this requires login credentials.
  2. Server creates a token but does not return it (it is kept in the database) - it returns a time stamp.
  3. Client generates a message based on time stamp, user and other data.
  4. Client hashes token with a secret key, provided outside of this process.
  5. Client sends token to the server.


  1. Receive the message
  2. If that token is in the database, it is valid

My reasoning behind taking out the message reconstruct is: that happened when the token was generated and the client couldn't know about the token in the database unless that knew how to generate it which means they authenticated and have a secret key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.