I'm currently implementing a rest web service with Spring+Java+Tomcat and a cmd client to access it. The most important requirement is to restrict the usage to authenticated users - encryption isn't that important.
Because I can't guarantee that the service is accessed via TLS, I can't use Basic Authentication with username and password.
My idea is to do the following:
- Get a nonce from the web service - that's changed after each request
- Calculate a signature with DSA of (request + nonce)
- Add signature to HTTP header and check it in the web service
How I would create the signature:
// To generate the keys
KeyPairGenerator keyGen = KeyPairGenerator.getInstance("DSA", "SUN");
SecureRandom random = SecureRandom.getInstance("SHA1PRNG", "SUN");
keyGen.initialize(1024, random);
KeyPair pair = keyGen.generateKeyPair();
// Per request
Signature dsa = Signature.getInstance("SHA1withDSA", "SUN");
dsa.initSign(pair.getPrivate);
dsa.update(...)
byte[] signature = dsa.sign();
To check the signature:
Signature sig = Signature.getInstance("SHA1withDSA", "SUN");
sig.initVerify(pubKey);
sig.update(...)
boolean ok = sig.verify(sigToVerify);
I hear so much about don't implement your own security, which is why I would like to know whether other people see something I don't.
Does someone see a major problem with this approach?