I am looking for a relatively simple (for the client to consume) but highly secure method for user authentication on my API. By secure I mean strong authentication. The API to be built will be RESTful and as such inherently stateless.
I do not want to use basic HTTP auth as the key must be passed in each API call. Even though the API will only be available over HTTPS there is always the possibility of a MITM attack due to the client trusting a malicious CA. Rather a long shot, but I'd like to do this right to protect the data being transmitted.
My proposal is to generate a key pair, give the private key to the client and hold the public and a finger print of the private key. The body of the API call would be encrypted with the private key and the finger print would be sent.
The server would then look up the fingerprint, match it to an account, retrieve the public key and attempt decryption. If it fails then it acts as though the user is not who they say they are (as indicated by the finger print).
- Is my design secure?
- Are there better alternatives?
- Any advice/guidance would be greatly appreciated.