6

I have a web-site for which I'm building a Drupal module that allows the users of that Drupal site to navigate to my web-site directly from the Drupal site.

I intend to distribute secret API-keys to each of the Drupal site administrators and they need to enter that value in their copy of the Drupal module.

When this Drupal site presents my module to its users, clicking on certain links should take the user to my site along with a set of secret data that my site can use to authenticate this navigation. There will be a FORM presented to the user and a link present so that clicking on the link 'submits' the form via POST and redirects the user as well.

I need to use this secret 'api-key' to generate some sort of time limited / one-time code that will be given to the user's browser. Any smart user copying this generated code shouldnt be able to reuse it to enter my site later on.

  1. Should I be using this API-key as a password to encrypt some data that matches the rest of the POST request? When receiving it, I decrypt it using my copy of their API-key and it if matches the rest of the data, I consider it validated?

  2. Or should I do some sort of one-way hashing - md5?

  3. Should I one-way hash the current time and allow access only for 5-10 minutes?

(moved from https://stackoverflow.com/questions/5549411/generating-one-time-tokens-from-api-key)

Improve this question
10
  • 3
    Can't you use Oauth to do that? Custom code == custom vulnerabilities
    – atdre
    Commented Apr 7, 2011 at 12:19
  • @atdre - ouch, yeah - we did consider that idea for a while, but it was too complex to setup
    – siliconpi
    Commented Apr 7, 2011 at 14:05
  • and actually, we cant go back in our implementation of this system (on the drupal end)...
    – siliconpi
    Commented Apr 7, 2011 at 14:19
  • whats the negative vote for??
    – siliconpi
    Commented Apr 8, 2011 at 11:12
  • I didn't do it! I like the question, but maybe people don't like your approach. If you were using CakePHP (or an even better framework like Django) then I could tell you how to leverage the framework itself for anti-CSRF tokens, but I don't think you're using those with Drupal, although maybe you can borrow some of their code anyways
    – atdre
    Commented Apr 8, 2011 at 17:43

2 Answers 2

Reset to default
4

First and foremost never use MD5 for anything related to security. It's a very broken algorithm. You should use anything from the SHA2 family, SHA256 is a great choice. One way of accomplishing this type of authentication is with an HMAC The API key could serve as the secret key K in the algorithm. The server with the secret API key would have to accept the post and provide the authentication token. The resulting message would have to have an ID and the message authentication code for that POST request. The ID could be the primary key for the API user, and the authentication code would be generated by the server that is using this API.

In this case Public Key Cryptography is overkill and a symmetric cipher ("encryption") isn't helpful at all.

Improve this answer
0

i did implement a long time ago a OTP (one time password) plugin to Joomla.

the source code is here.

What i did plan to do is, inside a valid session, i did generate OTP that would authenticate some actions, for a specific time. The OTP would be sent by a out-of-band channel as, for example, SMS. Unfortunately the project died, but i think this code base can be somehow useful for you.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .