Within my API backend i have a unique KeySalt for every API Key

public string Key { get; set; }

public byte[] KeySalt { get; set; }

public string KeyHash { get; set; }

When the user creates a new API key, I present the generated Key only once, (and store only the last 4 characters in the Key field) so the user can use it within my windows forms application.

With that been said, my windows forms application, should have besides the Key and the KeySalt in order to generate the KeyHash, so I can validate it against the KeySalt on the database.

The last one, doesn't mean that the user should also login first from my windows forms application to get the KeySalt?

For this reason, I feel that I have a chicken egg issue and missing something in the whole process. What am I missing here?

  • Not a clear question, though, have you ever heard Key Encryption key and Symmetric Key encapsulation Mechanism like the VeraCrypt uses? – kelalaka Nov 7 '20 at 10:52
  • Why are you doing any of this? What are you trying to prevent? – MechMK1 Nov 13 '20 at 10:49
  • @MechMK1 Just trying to store the api keys hashed in database – IAmNotARobot Nov 14 '20 at 10:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.