0

I am thinking about using nonce and secure request to API Server. Is this the right implementation for using nonce?

PURPOSE

  • Protect API Server from Replay attack
  • Protect API Server from MITM attack
  • Protect Core API Server from Resource exhaustion attack

IMPLEMENTATION

== ALL REQUEST IN HTTPS ==

PREPARATION:

  • [CLIENT] check if [session_id] exists

    • If exist use it
    • If not exist request [session_id] uuidv4 from [SERVER]
  • [SERVER] generate [session_id] and store it in database ( redis )

BEFORE ANY IMPORTANT REQUEST:

  • [CLIENT] request [snonce] from [SERVER] when submitting form / before api request with [session_id] or [auth_token_id :: if exist]
  • [SERVER] check throttle limit based on [session_id] or [auth_token_id :: if exist]

    • If allowed, continue
  • [SERVER] generates [snonce] with uuidv4, [snonce_id] with uuidv1

  • [SERVER] store [snonce] to database ( redis ) with [session_id] + [snonce_id] + [snonce] + [time_created]
    • There will be a cleanup service on [SERVER], deleting expired and unused [snonce]
  • [SERVER] return [snonce] + [snonce_id]
  • [CLIENT] generates [cnonce] from uuidv4
  • [CLIENT] generate [ticket] from SHA256

{ content = [snonce] + [auth_token :: if exist ], salt = [cnonce] }

  • [CLIENT] send ( [session_id] , [cnonce], [snonce_id], [ticket], [username :: if exist], [payload] )
  • [SERVER] checks if [ [session_id] + [snonce_id] exist in database and get all result ]
  • [SERVER] delete used [snonce] on database
  • If [username] exists, check and get [auth_token] from database
  • [SERVER] check [ticket] with SHA256

{ content = [snonce] + [auth_token :: if exist ], salt = [cnonce] }

  • Proceed with the request if valid.

QUESTION:

  • Is the above logic and implementation valid and secure?

  • Is it necessary to generate cnonce and SHA256 it since the request is already in HTTPS TLS?

  • 1
    Possible duplicate of How does SSL/TLS work? – MechMK1 Aug 7 at 7:32
  • These points are already covered by TLS. I don't know what a "Blind Attack" is, so some info on that would be nice. – MechMK1 Aug 7 at 7:34
  • @MechMK1, [deleted blind attack]. so all the hash and cnonce can be safely skipped? Thank you – ostrichegret Aug 7 at 7:38
  • I would highly recommend you to read about what TLS does for you, what attacks it mitigates and what is still up for you to do. – MechMK1 Aug 7 at 7:40
  • @MechMK1 will do, thank you very much for the link :) – ostrichegret Aug 7 at 7:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.