Need advices on API key & secret generation?

Question

While working on a Java project using Spring-boot, Spring-security and JWT token, I need to provide access via API key and secret. After searching on Google for a while about key/secret generation, here is what I found:

• For key generation, it seems a cryptographically-secured UUID without - would be a good choice.
• For secret generation, I didn't find a clear suggestion yet. But it seems some other sites are using the HMAC-SHA512 algorithm for the secret, and store it as base64 string representation (padded out to 88 characters) of the key.

Here are some links describe API key & secret:

• https://oauth.com/oauth2-servers/client-registration/client-id-secret/

An example from a bitcoin site, that provides API key/secret access:

• https://docs.gdax.com/?javascript#private

The questions are:

• What algorithm is suitable for the secret?
• Are the sha256 or sha512 algorithms a good choice? If yes, it would be helpful to have some suggestion on its generation.

Answer 1

I think you're confusing the security requirements for client IDs and secrets.

• Client ID: Must be unique, better if unguessable. While they are typically not publicly advertised, they are not treated as carefully as secrets are.
• Secrets: Must be unguessable and kept private. A potential leak of a secret is a security incident, requiring immediate revocation of the key.

What your client IDs look like is sort of a matter of taste. The examples in the oauth.com site you reference includes keys of varying sizes and formats. A random number is a fine choice. Something like (in pseudocode):

clientID = base64Encode(secureRandom(16)); // 16 bytes, 128 bits, 22 characters

In some situations you could use a non-secure random number, but there are situations where that may lead to predictability. So just stick with the secure random number generator - it's only a little slower and guaranteed to be safe.

The only way to generate a secret is with a secure random number generator:

secret = base64Encode(secureRandom(32)); // 32 bytes, 256 bits, 43 characters

Secrets should never be stored in clear-text. Encrypt them and store the encryption key somewhere secure.

You mentioned GUIDs, but even the random version 4 ones vary by implementation, some being secure and others not. So I'd just stay away from them. You also mentioned SHA256 and SHA512 hash algorithms. It is possible to use those in the calculation of a random number, but it's complex to get that right. Just stick with a secure random number generator and you'll be safe.

As you are already using Spring, RandomValueStringGenerator is probably a good choice for the implementation. Just create generators of the correct number of bytes. You can also look at the source code of that class for reference.