Questions tagged [hmac]

a method for constructing a message authentication code based on a cryptographic hash function.

28 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5
votes
3answers
11k views

What is a AUTH-KEY in the security of the computers?

I'm studying security in computers and in particular the URL Spoofing. I understand that a form of URL spoofing is phishing. Then I read that a countermeasure against phishing is the authentication ...
4
votes
0answers
121 views

how to create TPM_AUTHDATA as input in tpm commands ?

I'm writing my first program which use tpm (version 1.2) services in Windows 7 using TBS, in this program I'm trying to execute the TPM_CreateWrapKey command. I noticed that many commands like the ...
2
votes
0answers
668 views

HMAC authenticated API calls with multipart/form-data file uploads

We have an existing API where 3rd parties can push data. The API calls are authenticated with HMAC using the same scheme as described in Ruby's ApiAuth library which I use to verify signed requests. ...
2
votes
0answers
429 views

Allowing third-party clients to authenticate with an app server

I'm working on an app that is planned to be licensed to OEMs, who would in turn offer it as a service to their users.  We would host the app server and the OEM would optionally host the app's web ...
2
votes
0answers
400 views

Is hashing the HMAC secret key a good idea?

I'm implementing a REST API and I've generated 128-bit random API keys which are used with HMAC-SHA1 for authorization. Should I hash the secret key on both the client and server before using it, ...
1
vote
0answers
29 views

HMAC with random application Id and secret with DPAPI

We have open endpoints because there is a flow where access token is still not presented. Because of that, I've implemented HMAC + DPAPI (using Azure Blob Storage) to store the keys, without involving ...
1
vote
0answers
48 views

Signing event-stream responses

I am working on an application where the general approach is signing most response payloads with HMAC, but there are a couple of endpoints that return text/event-stream in the response. What is the ...
1
vote
1answer
152 views

I am signing (HMAC) outgoing webhooks to allow users to verify their source, should I also sign outgoing responses?

To allow api users to verify the authenticity of outgoing webhooks, I am using a similar model to slack: Concatenate timestamp and body, HMAC with pre-shared key, add timestamp and HMAC digest to ...
1
vote
0answers
64 views

concatenation vs multiple rounds of HMAC

I was studying the AWS request signature process and found that they derive the signing key from multiple sources (one and two related questions). Specifically this: kSecret = Your AWS Secret Access ...
1
vote
0answers
248 views

API protection - JWT vs HMAC signing vs OAuth

Lets say you are designing a new API. The consumer of your API is a mobile app that periodically sends requests in the background, but you expect other consumers as well, such as web apps or servers. ...
1
vote
0answers
60 views

Can we send a forms auth token back from an HMAC API?

We have an ASP.NET MVC application used by people from other organisations. Some of the features are accessible via a forms login. Other features are accessible as SHA256-HMAC-authenticated API ...
1
vote
0answers
603 views

SQLCipher and PRAGMA key on iOS

I'm a bit confused as to how SQLCipher handles the PRAGMA key provided for encrypting the SQLite database For background: I'm looking at options for encrypting application data at rest. From the ...
1
vote
0answers
63 views

Is my current implementation of message signing on AVR sufficient and correct?

I am currently implementing a fairly simple signing library (for my personal use) to verify the identity of packets sent with the RF24Mesh library (using NRF24L01+) radios. Never made a flowchart but ...
1
vote
0answers
588 views

HMAC Token - Check Logic

I have a situation where I need a token that provides authentication. The common HMAC procedure I found is: Get Some key using login credentials Create Message, append key and other message data (...
1
vote
0answers
338 views

How can I use session salt for encrypting data using AES in CTR mode?

I have to implement a crypto-plugin in Java. The approach followed is conceptually similar to that used for SRTP. The algorithm used for data confidentiality is AES in CTR mode (I'm following a ...
1
vote
0answers
461 views

Login Authentication with SSL and HMAC

My question is pretty similar to : https://stackoverflow.com/questions/5487757/using-hmac-sha1-for-api-authentication-how-to-store-the-client-password-secure. Basically, I want to write an API for my ...
1
vote
0answers
488 views

Gladman's file encryption library = AES in counter mode with HMAC-SHA1 authentication?

I would like to use Gladman's algorithm to create AES encrypted data in JavaScript. I use the Crypto-JS library, but its performance is horrible. PBKDF2 is terribly slow, so I switched to another ...
1
vote
0answers
611 views

Generating API keys within an OAuth2 session for non-web-browser clients

I am using Google's OAuth2 for authentication for a website which also has a RESTful API component. I would like to support connections from clients which are not within a web browser. Also, I'd ...
0
votes
0answers
49 views

Best secure approach with Basic Auth

Due to several customer reasons our product needs to support Basic Auth as primary authentication mechanism with client's service account. We are using Bcrypt to store customer's password in our DB, ...
0
votes
1answer
33 views

Need a test vector for the putty ssh-2 file mac validation

I'm trying to implement the putty file format in one of my dart packages. Implementing the actual key loading was ok, but I'm struggeling with the mac validation. I'm not shure what I'm doing wrong ...
0
votes
0answers
25 views

Authentication Cookie Security Features

I am completely stuck and I need to make sure that I am correct. Any help is greatly appreciated. Based on the cookie, I need to answer these questions: Select which security features does the cookie ...
0
votes
0answers
280 views

cracking HMAC-SHA1 when the password and seed are inverted

I happen to have a few hashes generated with code that did this (it has been changed to use a more "standard" bcrypt call): $ python3 >>> import hmac >>> hmac.new(b'The ...
0
votes
0answers
203 views

Is it safe to use HMAC to create an API key?

I am planning to create an API key using the user's password as message and a random number assigned to that user in my database as key (or vice-versa). I will then store the hash of that API key in ...
0
votes
0answers
47 views

Does transmitting short, predictable plaintext along with the HMAC signature of that text present a security risk

In order to allow clients to verify responses originating from our server, we are generating an HMAC signature of the body and a timestamp, and attaching it as a header. The timestamp is also attached ...
0
votes
0answers
64 views

Is this symmetric key system secure?

I am creating a secure network data transfer system, and would like to know if there are any obvious flaws in this scheme. Secrets The secret is a password that is known to both clients. This ...
0
votes
0answers
313 views

Understanding the application of hashes, HMACs, and KDFs

I think that I understand the right application cases for the following crypto functions, but I'd like to confirm my understanding and also propagate the safe use of crypto throughout the intertubes. ...
0
votes
0answers
150 views

Using HMAC when sending data through an untrusted server

I have a set up like this: Payment Server (PS) <> Front End (FE) <> Client JS. I need to get some data from the Client JS to the PS, without the FE being able to modify it and have PS prove ...
0
votes
0answers
267 views

Payment Application Integration - Encryption or HMAC

Doing an integration with an online payment provider. Payment provider will be making a web request to my server to provide some information about the basket content. On my end there's no payment ...