Binance public API supports access to specific operations with RSA key pair. Firstly customer generates an RSA key pair. The customer uses the secret key to hash(SHA256) the query string parameters and puts the hash value in the query string. The public key is sent in the same HTTP call in the headers.
Binance compares the same hash in the server to check query string parameters are not changed by a man in the middle. There is no use for RSA encryption in this communication. Just two different numbers, one as sent as API key, the other used to calculate the hash.
We are about to develop a similar security mechanism. I insist to use generating an RSA key pair but one of my teammates suggests using two different random numbers(one for public and the other for private key).
Is there any security vulnerability for using 2 different random numbers?