When using HMAC-SHA256 do I must save the secret in the databse to verify the sender?

Question

Many API's I found that using same method for authentication:

Signature is a HMAC-SHA256 encoded message containing nonce, customer ID (can be found here) and API key. The HMAC-SHA256 code must be generated using a secret key that was generated with your API key. This code must be converted to it's hexadecimal representation (64 uppercase characters).

https://www.bitstamp.net/api/

I believe that for making it works, the service provider must keep a copy of the API secret, and then he can check if the user used the same secret to generate the signature.

I'm thinking that it is very insecure, and it is like storing a plain password in the database. Anyone who get an old database backup have the secrets of all the users.

Am I miss something? There is a method for the server, to check that the user encoded a signature using specific secret, without storing the secret in the database?

Because of this, I think to provide the user a private key of OpenPGP pair, and then I can validate the signature using the public key.

Do you think, that there is a security flaw in the way bitstamp for example, working, and OpenPGP would be better?

Answer 1

HMAC-SHA256 is a message authentication code that uses a shared secret between the two communicating parties. It is absolutely necessary that both ends possess the same key (and anyone with that key can both generate and validate messages). So yes, your conclusion that the service provider still has the key is a correct intuition. (They could either store the key or use some mechanism for deterministic regeneration.)

An asymmetric keypair (OpenPGP being one example) would avoid this, but does have a far more complex implementation, more room for error, and higher compute times on both ends for the communications.

In the case where they regenerate the HMAC key, it could be done in a fashion that would make it difficult for an attacker to steal the key. Perhaps they compute an HMAC(username, secret) using a secret that is stored in an HSM. This would allow them to deterministically generate the API key without needing to store it in the clear. Using an HSM makes it very difficult for an attacker to steal the secret needed to generate per-user keys.

The decision as to which is appropriate would depend on several factors, including the necessary integrity requirements for the service in question. Perhaps the service provider considers that the damage that would be done by a leaked database is not made worse due to API keys being included -- if the information is much more valuable or the site only serves to allow retrieving information from that database, then the access to API keys adds little to the attacker's bounty.