I am trying to come up with a way to implement token-based authentication for a REST API without the need for SSL.
Don't!
Use SSL (well, TLS actually).
nothing that isn't public already is going over the wire
This is obviously not exact:
- the user name is captured; TLS would hide user name (I am not saying it is a serious still, but it is an information which is disclosed);
- a hash based on available information is captured and passwords can now be tried (dictionary attack).
I have only started looking at security therefore pretty much a novice at this stuff so any help/advice would be appreciated!
Use the proper tools. Don't try make your own protocols. If you try to come up with your own security protocols, they will almost always be flawed.
There are many issues with your protocol:
- discloses user name (might not be huge issue, but still)
- discloses password hash: allows off-line attack on password
- the server needs to know all passwords in clear-text (either by storing them in clear-text, or storing them encrypted with symmetric encryption, and storing the encryption key) (well not the user password, but the real user secret authenticator)
- and the worst part: absolutely no protection against an active attacker