In order to allow clients to verify responses originating from our server, we are generating an HMAC signature of the body and a timestamp, and attaching it as a header. The timestamp is also attached as a header. Clients will concatenate the timestamp and the body, and HMAC using the pre-shared key, comparing it to the signature header.

It is not particularly difficult to guess that the base string of the signature is some combination of the body and the timestamp. Given that the body could sometimes be empty, does this pose a security risk? An attacker could make as many requests as they like, receiving the timestamp, and the sha256 HMAC signature of that timestamp (since the body is empty). Would this allow them to eventually deduce the key used? Would it be better to include a random nonce in the base string, as well as the body and the timestamp.

  • "An attacker could make as many requests as they like" - no. Only as they manage to do which is a lot different from what they probably like. Essentially they get only comparably few known plaintexts. And then they have to brute force based on this. See also Brute force HMAC SHA256 (HS256) equals to break JSON web token signature?. Feb 2, 2020 at 19:13
  • @SteffenUllrich Fair enough, that helps, thank you. In that case, is it a problem that the timestamp is only twelve characters long (and therefore in the case of an empty body, the plaintext is only 12 characters long)? Would it be better to add some extra nonce to increase the length?
    – Alex
    Feb 2, 2020 at 19:18
  • Note that you are only describing in the question that you use a HMAC but not what kind of threat you are trying to prevent with this. Therefore one cannot decide if your design achieves your unknown goal. If you want to prevent that some MITM can change the input to a different but valid one then a nonce will help if it is controlled by the recipient of the message. If it is only controlled by the sender then the MITM could just replay a previously captured message. Feb 2, 2020 at 19:27
  • Ok, nonce is the wrong word, sorry. The purpose of this is to ensure that the message has not been altered. The question I meant to ask in my previous comment is this: given that the plaintext may sometimes be as short as 12 characters (I.e. when the body is empty) should I add something to it to increase its minimum length?
    – Alex
    Feb 2, 2020 at 19:32
  • 1
    The problem here is not that the attacker will crack the HMAC and is then able to fabricate its own messages but that the attacker can simply replay previous messages. Thus you don't need some (random) padding to increase the length but instead need to have a replay protection. This can be a nonce specified by the recipient but also a sequence number set by the sender which allow the recipient to detect and discard older (replayed) messages. Feb 2, 2020 at 19:39


You must log in to answer this question.

Browse other questions tagged .