I want to make a service stateless(has no data to store or mantain). But the service shoule be able to authenticate user.

What I'm considering is using key derivation function with a shared master secret key and username to calculate user password each time when user login. The KDF should ensure it generates the same password everytime for specific user. The service will deliver the derived password to correspond user.

For example, use PBKDF2 and use username+secret_shared_master_key as the password, kinda like a username-based key derivation function

I'm wondering is this way secure cryptographically? Thanks in advance!

After some discussion with SteffenUllrich in comments, seems using HMAC(secret_master_key, username) or PBKDF2(HMAC(secret_master_key, username)) as the user's password is one option to do the thing.

  • In the current scheme every user seems to get the same secret key. In that case, you're only one hack away from compromising every user.\ – Maarten Bodewes Oct 30 '19 at 1:30
  • Comments are not for extended discussion; this conversation has been moved to chat. – schroeder Oct 30 '19 at 7:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.