security - How to implement HMAC-SHA authentication from scratch? -


i implement authentication web app api using similar technique aws signature process. server render html user web browser clients. app return json non-browser clients (iphone, android, blackberry, ipad, etc.) trying write authentication code allow single user signed (remembered) in app multiple clients. logging out 1 client should not revoke token/cookie other clients.

  1. when user sign or logs in, how client (native mobile client or web browser especially) private/secret key? understanding key should not sent on network? can sent on ssl?

  2. for browser clients private key stored in cookie or in other form of local storage?? i.e. generic api token authentication token stored in cookie on browser , in db on phone

  3. when client browser, how sign request signature private key? i.e. generate hash of id + private key + request. native mobile clients or server server communication believe there libraries can used generate signed request. when request originates browser how work?

  4. if user required remembered on multiple clients (tablet, iphone, work computer, home laptop, etc.) user need have set of private keys/tokens each client?

i have used devise rails requires write own token authentication code.

i looking @ oauth, questions 2 , 4 both apply to, investigate aws method.

you start solution (hmac) not think "problem" fits solution :).

i'll try answer best of knowledge.

  1. to understanding ,a private key derived of public key shared. or share private key, if authentication established (in other words: know sure talking to) , connection secured (encrypted). still vulnerable man in middle attacks though.
  2. i'm not sure. cookie not secure. steal cookie, steal private key. preference locally stored key(file or storage), encrypted password.
  3. you have devise sort of client side library (in javascript or it).
  4. yes.

why share keys when share token, oauth implements. token generated application , valid limited time. way share access, not means aquire access application. login username , password (or keyfile) , token grants access untill token revoked.


Comments

Post a Comment

Popular posts from this blog

Android layout hidden on keyboard show -

i have strange problem layout. when tap on edittext , keyboard shown edittext stay on bottom , when tap on to hide keyboard , keyboard hides , edittext go should when want input text. when tap again, keyboard shown , edittext goes down behind keyboard... <relativelayout android:layout_width="match_parent" android:layout_height="match_parent" > <scrollview android:layout_width="match_parent" android:layout_height="fill_parent" android:above="@+id/rl_commands"> <textview android:layout_width="match_parent" android:layout_height="wrap_content"/> </scrollview> <relativelayout android:layout_width="match_parent android:layout_height="24dp" android:id="@+id/rl_commands" android:alignparentbottom="true">
Read more

google app engine - 403 Forbidden POST - Flask WTForms -

i have flask application running on google app engine. trying submit form built using wtform , keep getting following error. 403 forbidden: don't have permission access requested resource. either read-protected or not readable server. location.html (part of code) <form method=post action="/home/location"> .... <button type="submit" class="btn btn-primary" value="submit"> directions </button> </form> main.py @app.route('/home/location', methods=['post', 'get']) def location(): form = cfcdirections.direction(request.form) print(request.method) if request.method == 'post' , form.validate(): print("after if") directions = cfcdirections() street_no = directions.no street = directions.street suburb = directions.suburb postcode = directions.postcode
Read more

c - Why would PK11_GenerateRandom() return an error -8023? -

i looking through internet trying find source of pk11_generaterandom() function see why function fail. have program uses function when moved new flavor of linux, fails after forking ( fork() ) since not believe there problem nss, suspect doing incorrectly disregarded in older versions of linux new 1 there issue. the openssl package same on 'good' , 'bad' server: openssl 0.9.8e-fips-rhel5 01 jul nss rpm differs though. 'good' has nss-3.12.2.0-2.el5 and bas has version nss-3.15.3-4.el5_10 the 'good' server uses quite obsolete linux: linux 2.6.18-128.el5 #1 smp wed jan 21 08:45:05 est 2009 x86_64 x86_64 x86_64 gnu/linux enterprise linux enterprise linux server release 5.3 (carthage) red hat enterprise linux server release 5.3 (tikanga) the 'bad' server newer: linux bad 2.6.18-371.4.1.el5 #1 smp wed jan 29 11:05:49 pst 2014 x86_64 x86_64 x86_64 gnu/linux oracle linux server release 5.10 red hat enterprise linux server release
Read more