2

I'm working on the authentication strategy for my app (again). My current strategy is a clone of the AWS strategy of issuing public and private keys and using them to sign requests sent to my API.

My understanding is that this is a reasonably secure way to authenticate API consumers. However, AWS is phasing out this practice, and I don't really know why.

Is there something I don't know about Private/Public key authentication that poses a security risk to my service or its users?

Is it safe to continue this practice, or should I bite the bullet and move to OAUTH or some other strategy?

The context for the sake of this question is that this strategy is used to authenticate consumers of my JSON-RPC API. Client-side, the private key is used to hash various data contained within the JSON object; server-side the same key is retrieved to compare a hash of the data received with the signature.

Thanks for any help.

closed as off-topic by Eric G, Xander, user10211, AJ Henderson, Adi May 21 '14 at 13:50

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Eric G, Xander, Community, AJ Henderson, Adi
If this question can be reworded to fit the rules in the help center, please edit the question.

Browse other questions tagged or ask your own question.