0

say i want an application to integrate my services & need some way of verifying requests from that application, i have an integration key, and a shared secret, i can generate a generate a signature using those values & match it on server side. but for that i need to send integration key along with my request.

but as described here ,https://duo.com/docs/duoweb this service just passes the signature without integration key, so i am guessing they manually iterate on all integration keys & secrets and generate mac for each of them then compare the signature.

any particular reason for doing that?

1 Answer 1

2

this service just passes the signature without integration key

It doesn't, although I can forgive you for making that mistake. The function name is a bit misleading.

sign_request isn't a particularly accurate description of what it does. It MACs the request (I assume they say "sign" simply because the average developer will have no idea what a MAC is), but it also includes the request itself in the returned data.

Given:

ikey = '3pA0XSAwHBOkyGH43WlZ'
skey = '21FNMyZQ15c4GqTHzUnJUGpYTp35LXieMfxAulY3'
akey = 'rVbrzSNJNBKyspIZgabSt3m8C6zIs20zrJF27t65'
username = 'johndoe'

sign_request will return:

TX|am9obmRvZXwzcEEwWFNBd0hCT2t5R0g0M1dsWnwxNTQ4MzQwNDY0|f8ab99bf117ec109c16b7193b5be7e16238a46f8:APP|am9obmRvZXwzcEEwWFNBd0hCT2t5R0g0M1dsWnwxNTQ4MzQzNzY2|307f27ee3ea75c09c2f2b4e8b3089b49c167b88f

Picking that apart:

  • TX is the hard-coded "DUO_PREFIX"
  • am9obmRvZXwzcEEwWFNBd0hCT2t5R0g0M1dsWnwxNTQ4MzQwNDY0 is the base64 encoding of johndoe|3pA0XSAwHBOkyGH43WlZ|1548340464, which is username|ikey|expiration-timestamp (expiration being 5 minutes from the current time)
  • f8ab99bf117ec109c16b7193b5be7e16238a46f8 is the hex-encoded MAC of TX|username|ikey|5m-expiration-timestamp using skey
  • APP is the hard-coded "APP_PREFIX"
  • am9obmRvZXwzcEEwWFNBd0hCT2t5R0g0M1dsWnwxNTQ4MzQzNzY2 is the base64 encoding of johndoe|3pA0XSAwHBOkyGH43WlZ|1548343766, which is username|ikey|expiration-timestamp (expiration being 1 hour from the current time)
  • 307f27ee3ea75c09c2f2b4e8b3089b49c167b88f is the hex-encoded MAC of APP|username|ikey|1h-expiration-timestamp using akey

So ikey is actually included twice in the request.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .