I'm reviewing API documentation from a potential supplier.
In order to gain access to the useful parts of the API, we have to send a GET or POST request to a particular endpoint passing two parameters - our organization name and the "public key hash". This endpoint will then return a token that we use for the remainder of our session.
The description of the "public key hash" is that we take a public key (provided in advance to us by the supplier), append the current UTC date and then perform an MD5 hash of the result. Their example is:
Public Key: a8db14aef3810a92e7c9af9f8782e1f0
Current UTC Date: 2013-02-28
Result string: a8db14aef3810a92e7c9af9f8782e1f02013-02-28
MD5 hash: efdb500ca0a4e107aea100554456ea85
I've not encountered an authentication mechanism like this before. It feels "hand-rolled" to me, and the use of MD5 is also setting my nose hairs twitching - do I really want to be writing new code in 2017 that uses MD5?
But before I really dig into things - is this actually a well-known and used authentication mechanism that I've just failed to find any documentation for? If so, is it actually still considered to be safe?
(Searching on the API key value in the example produces no results, so they've at least rolled a unique example for some reason. Searching on API authentication md5
didn't find any promising results either)