0

say i want an application to integrate my services & need some way of verifying requests from that application, i have an integration key, and a shared secret, i can generate a generate a signature using those values & match it on server side. but for that i need to send integration key along with my request.

but as described here ,https://duo.com/docs/duoweb this service just passes the signature without integration key, so i am guessing they manually iterate on all integration keys & secrets and generate mac for each of them then compare the signature.

any particular reason for doing that?

2

this service just passes the signature without integration key

It doesn't, although I can forgive you for making that mistake. The function name is a bit misleading.

sign_request isn't a particularly accurate description of what it does. It MACs the request (I assume they say "sign" simply because the average developer will have no idea what a MAC is), but it also includes the request itself in the returned data.

Given:

ikey = '3pA0XSAwHBOkyGH43WlZ'
skey = '21FNMyZQ15c4GqTHzUnJUGpYTp35LXieMfxAulY3'
akey = 'rVbrzSNJNBKyspIZgabSt3m8C6zIs20zrJF27t65'
username = 'johndoe'

sign_request will return:

TX|am9obmRvZXwzcEEwWFNBd0hCT2t5R0g0M1dsWnwxNTQ4MzQwNDY0|f8ab99bf117ec109c16b7193b5be7e16238a46f8:APP|am9obmRvZXwzcEEwWFNBd0hCT2t5R0g0M1dsWnwxNTQ4MzQzNzY2|307f27ee3ea75c09c2f2b4e8b3089b49c167b88f

Picking that apart:

  • TX is the hard-coded "DUO_PREFIX"
  • am9obmRvZXwzcEEwWFNBd0hCT2t5R0g0M1dsWnwxNTQ4MzQwNDY0 is the base64 encoding of johndoe|3pA0XSAwHBOkyGH43WlZ|1548340464, which is username|ikey|expiration-timestamp (expiration being 5 minutes from the current time)
  • f8ab99bf117ec109c16b7193b5be7e16238a46f8 is the hex-encoded MAC of TX|username|ikey|5m-expiration-timestamp using skey
  • APP is the hard-coded "APP_PREFIX"
  • am9obmRvZXwzcEEwWFNBd0hCT2t5R0g0M1dsWnwxNTQ4MzQzNzY2 is the base64 encoding of johndoe|3pA0XSAwHBOkyGH43WlZ|1548343766, which is username|ikey|expiration-timestamp (expiration being 1 hour from the current time)
  • 307f27ee3ea75c09c2f2b4e8b3089b49c167b88f is the hex-encoded MAC of APP|username|ikey|1h-expiration-timestamp using akey

So ikey is actually included twice in the request.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.