I had a friend say:

We're securing our microservice with an HMAC derived from the private key in the jks file. [Where client and server shared the same private key]

I can understand the situation where you have an HMAC from a secret that is short lived - such as one derived from Hashicorp Vault.

But if the HMAC has the same lifetime as the private keys - why not just secure the microservice using SSL based on the private keys you've already installed?

My question is: Is there value to signing microservice calls with an HMAC derived from the same private key?

  • What private key? Typically a private key would only be known by one end. If the client generates the hash, the server has no way to verify. – paj28 Mar 23 '17 at 10:19
  • Thanks - that's helpful. I've clarified the question to state that both client and server share the private key. – hawkeye Mar 25 '17 at 3:02

If client and server share the same private key, private key basically turns into as a symmetric secret, thus nullifying any use-case relevant for SSL, or, FWIW, any signing scheme.

It's basically integrity without authenticity.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.