All Questions

Tagged with
Filter by
Sorted by
Tagged with
1
vote
3answers
216 views

How secure is using MD5 for signature

Generally speaking, MD5 is considered as broken for secure usage these days, but I came across a signature design using MD5 many times recently in my company. The detail shows as following: T = text, ...
0
votes
1answer
78 views

hmac based request signature for verification

say i want an application to integrate my services & need some way of verifying requests from that application, i have an integration key, and a shared secret, i can generate a generate a ...
5
votes
3answers
795 views

Why would I use MAC over digital signature?

As far as I've read, there is no benefit of a MAC over a digital signature - except the fact that it is faster to generate and process. Is this true? Digital signatures (asymmetric encryption) seem ...
2
votes
1answer
316 views

The application of HMAC vs CMAC vs DAA

So HMAC, CMAC, DAA are different algorithms for generating MAC based symmetric block ciphers. If all use symmetric ciphers to produce MAC, what is the key difference between them? In other word, why ...
2
votes
1answer
4k views

Why is CBC-MAC insecure for variable length input?

Can anyone explain why CBC-MAC is not secure for variable length message? I read many books, but there are still some confusion. Like the highlighted parts in following pictures Slide 32: Slide 33: ...
2
votes
1answer
2k views

Request signing for REST API

I am building a REST API that will receive requests like: GET /api/entities GET /api/entities?filter=X&sort=Y This seems straight forward: have the client HMAC(path + query, key), send me a key ...
3
votes
1answer
1k views

Signing (HMAC) cookie identifier

Related to this other question about sharing the secret to sign the cookies, my question is more trivial: how really secure is to sign a simple cookie identifier? In example, expressjs#session ...
4
votes
1answer
201 views

Generating secret keys with secret keys

Hydra is a secretive organization. It is comprised of several Directors at the top, and many Agents underneath them. A Director sends Agents on secret missions. During these missions, communication ...
2
votes
1answer
160 views

What is the ideal HMAC message format if message is an array?

I'm using HMAC exactly as intended to verify the integrity of a message. However, the message is really an associative array (or a hash). Since this will be done on various platforms (within and ...
1
vote
1answer
394 views

Is this signature methodology secure?

I'm working on authentication for my JSON-RPC API and my current working strategy is using signed requests sent via POST over SSL. I'm wondering if anyone can see any vulnerabilities that I haven't ...
2
votes
2answers
91 views

Which signing strategy?

I have a device which should lock and unlock something after receiving a signed server response. So in the best case a loop would lock like this: User locks device User wants to unlock device User ...
-5
votes
2answers
183 views

Protection of online image file (ancient manuscript) [duplicate]

I am going to protect an image file (ancient manuscript) which will be available online for everyone to download. I want to protect the file in these situations: When it's on the server, I need to ...
10
votes
3answers
3k views

API message verification without storing private key?

I'm in the process of implementing a public API for my web service. Security is a key concern as money is involved. It seems the current common practice for "authenticating" users in API requests is ...
4
votes
1answer
422 views

How do I build a secure signing mechanism on top of HMAC

Say we have a system with strong shared keys (not passphrases), and we're trying to sign messages sent by the server that will be visible to an attacker. E.g. storing session state in a signed cookie. ...
4
votes
2answers
807 views

Reusing HMAC state for multiple messages

I have a secret key k and message m. I send m || HMAC(m, k) to some other party, who can verify the integrity of m, assuming that they know k. Suppose I have multiple messages m1, m2, and so on. ...