I have a scheme for a cookie with high-level confidentiality of information. The information to be hidden from the client is the expiration time of the cookie. I am wondering what insecurities i am opening myself up to with this scheme.
Note below that
| denotes concatenation and
(text)k is text encrypted using key k.
cookie = creation_time | (expiration_time)k | HMAC(creation_time|expiration_time|server_key , k) where k = HMAC(creation_time, server_key)
Steps for key validation are:
- Ensure creation_time is valid time stamp
- create k = HMAC(creation_time, server_key)
- decrypt (expiration_time)k using k.
(expiration_time - creation_time <= T)&&
current_time < expiration_timewhere
Tis a server allowed TTL for a cookie.
- compute HMAC(creation_time | expiration_time| server_key, k) and compare against the cookie value. if they are the same the cookie is valid.
The whole point of this cookie is to allow me ensure a cookie is received by the user at one point and pinged back through ajax within a time