Questions tagged [hmac]

a method for constructing a message authentication code based on a cryptographic hash function.

20 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
7
votes
3answers
7k views

What is a AUTH-KEY in the security of the computers?

I'm studying security in computers and in particular the URL Spoofing. I understand that a form of URL spoofing is phishing. Then I read that a countermeasure against phishing is the authentication ...
4
votes
0answers
59 views

Proper way to combine multiple secrets into one HMAC key?

I am using HMAC+SHA256 to sign and verify claims in a web application. Each deployment has its own crypto-random 512-bit secret that I can use as the HMAC key, but in some cases I want to mix in ...
4
votes
0answers
99 views

how to create TPM_AUTHDATA as input in tpm commands ?

I'm writing my first program which use tpm (version 1.2) services in Windows 7 using TBS, in this program I'm trying to execute the TPM_CreateWrapKey command. I noticed that many commands like the ...
2
votes
0answers
555 views

HMAC authenticated API calls with multipart/form-data file uploads

We have an existing API where 3rd parties can push data. The API calls are authenticated with HMAC using the same scheme as described in Ruby's ApiAuth library which I use to verify signed requests. ...
2
votes
0answers
390 views

Allowing third-party clients to authenticate with an app server

I'm working on an app that is planned to be licensed to OEMs, who would in turn offer it as a service to their users.  We would host the app server and the OEM would optionally host the app's web ...
2
votes
0answers
387 views

Is hashing the HMAC secret key a good idea?

I'm implementing a REST API and I've generated 128-bit random API keys which are used with HMAC-SHA1 for authorization. Should I hash the secret key on both the client and server before using it, ...
1
vote
0answers
56 views

Can we send a forms auth token back from an HMAC API?

We have an ASP.NET MVC application used by people from other organisations. Some of the features are accessible via a forms login. Other features are accessible as SHA256-HMAC-authenticated API ...
1
vote
0answers
512 views

SQLCipher and PRAGMA key on iOS

I'm a bit confused as to how SQLCipher handles the PRAGMA key provided for encrypting the SQLite database For background: I'm looking at options for encrypting application data at rest. From the ...
1
vote
0answers
56 views

Is my current implementation of message signing on AVR sufficient and correct?

I am currently implementing a fairly simple signing library (for my personal use) to verify the identity of packets sent with the RF24Mesh library (using NRF24L01+) radios. Never made a flowchart but ...
1
vote
0answers
541 views

HMAC Token - Check Logic

I have a situation where I need a token that provides authentication. The common HMAC procedure I found is: Get Some key using login credentials Create Message, append key and other message data (...
1
vote
0answers
288 views

How can I use session salt for encrypting data using AES in CTR mode?

I have to implement a crypto-plugin in Java. The approach followed is conceptually similar to that used for SRTP. The algorithm used for data confidentiality is AES in CTR mode (I'm following a ...
1
vote
0answers
408 views

Login Authentication with SSL and HMAC

My question is pretty similar to : https://stackoverflow.com/questions/5487757/using-hmac-sha1-for-api-authentication-how-to-store-the-client-password-secure. Basically, I want to write an API for my ...
1
vote
0answers
410 views

Gladman's file encryption library = AES in counter mode with HMAC-SHA1 authentication?

I would like to use Gladman's algorithm to create AES encrypted data in JavaScript. I use the Crypto-JS library, but its performance is horrible. PBKDF2 is terribly slow, so I switched to another ...
1
vote
0answers
607 views

Generating API keys within an OAuth2 session for non-web-browser clients

I am using Google's OAuth2 for authentication for a website which also has a RESTful API component. I would like to support connections from clients which are not within a web browser. Also, I'd ...
0
votes
0answers
19 views

How to use public keys with asymmetric cryptography to dynamically create a shared secret for HMAC?

I have a mobile app (iOS and Android) and I'm trying to implement HMAC with Node.js as the backend. Currently I have a static shared key for symmetric HMAC(e.g. "ABC123") which is hardcoded in both ...
0
votes
2answers
92 views

How to protect HMAC key embedded in code from someone who would copy entire source?

I and a friend are developing a web game. The front-end to back-end communication will be carried out by the means of an API. We realized that someone could then easily hook up to our API and make a ...
0
votes
0answers
40 views

Is there a protocol fuzzer or fuzzing framework that uses cryptography?

When reading about fuzzing, the way to go seems to ignore checksums and cryptographic integrity protection or at least circumvent verification procedures via a 'fuzz-friendly mode'. For black-box ...
0
votes
0answers
227 views

Understanding the application of hashes, HMACs, and KDFs

I think that I understand the right application cases for the following crypto functions, but I'd like to confirm my understanding and also propagate the safe use of crypto throughout the intertubes. ...
0
votes
0answers
147 views

Using HMAC when sending data through an untrusted server

I have a set up like this: Payment Server (PS) <> Front End (FE) <> Client JS. I need to get some data from the Client JS to the PS, without the FE being able to modify it and have PS prove ...
0
votes
0answers
223 views

Payment Application Integration - Encryption or HMAC

Doing an integration with an online payment provider. Payment provider will be making a web request to my server to provide some information about the basket content. On my end there's no payment ...