0

I am trying to create an authentication header algorithm that can be used for authentication on HTTP server.

Not sure it is good but it seems OK to me. I also used similar approaches for previous WS architectures and wanted be sure about this.

I would like to hear if it is suitable or contains any security flows in it.

Authentication Headers;

AuthX: SHA256($TIME)
AuthY: XOR(CONCAT($TIME + STATIC_KEY2) <- STATIC_KEY1)

$TIME -> Unix epoch time in milliseconds which very dynamic
$STATIC_KEY1 -> Shared static key on both client and server. Used for XOR algorithm
$STATIC_KEY2 -> Shared static key2 on both client and server. Used for mixing XOR value.

The Server will do this to validate;

Decrypt XOR and retrieve $TIME value.

1- XOR decrypt should be understandable where STATIC_KEY1 validated

2- Calculated: SHA256($TIME) == AuthX

3- Retrieved: STATIC_KEY2 == Server hold STATIC_KEY2

4- $TIME should be at most 10 minutes late. This controls expired tokens

Dynamic Values;

1- $TIME is dynamic so AuthX will be dynamic for every call.

2- Due to the $TIME AuthY is also dynamic even though STATIC_KEY2 preserved in there.

Overall: Both header dynamically changed for each request and due to the expire control, old headers cannot be used.

  • 3
    There are well established primitives for message authentication, such as HMAC, i.e. send Time and HMAC(Time, Secret). This also easily extends to HMAC(Time || Body, Secret) for tamper resistance. Why invent your own? – Peter May 13 at 11:32
  • 1
    @Peter actually your comment is what I want to hear. Because I do not know the name of this approach (HMAC). I will also check it out. Thanks! – Berkay May 13 at 11:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.