I am trying to create an authentication header algorithm that can be used for authentication on HTTP server.
Not sure it is good but it seems OK to me. I also used similar approaches for previous WS architectures and wanted be sure about this.
I would like to hear if it is suitable or contains any security flows in it.
AuthY: XOR(CONCAT($TIME + STATIC_KEY2) <- STATIC_KEY1)
$TIME -> Unix epoch time in milliseconds which very dynamic $STATIC_KEY1 -> Shared static key on both client and server. Used for XOR algorithm $STATIC_KEY2 -> Shared static key2 on both client and server. Used for mixing XOR value.
The Server will do this to validate;
Decrypt XOR and retrieve
XOR decrypt should be understandable where STATIC_KEY1 validated
Calculated: SHA256($TIME) == AuthX
Retrieved: STATIC_KEY2 == Server hold STATIC_KEY2
$TIME should be at most 10 minutes late. This controls expired tokens
$TIME is dynamic so AuthX will be dynamic for every call.
2- Due to the
$TIME AuthY is also dynamic even though STATIC_KEY2 preserved in there.
Overall: Both header dynamically changed for each request and due to the expire control, old headers cannot be used.