CODEWITHSUNDEEP
restauthenticationhash
thertweck
thertweck

Reputation: 1120

REST(ful) simple authentication without SSL and HMAC?

I wonder if it is possible to have an easy authentication method that is restful, fast and provides a litte security.

SSL is not an option, because I can't rely on a valid SSL Certificate on the server of clients. Also HMAC is not really possible because the body of the request should be signed, when used properly, but in my case that body could be a large file. Further should the authentication be possible with JavaScript/AJAX.

I thought about something really simple. What's the problem with that one:

HEADER: X-Authentication: timestamp:username:sha256(timestamp:password)

The server knows the users password and could check the hash, the timestamp is used to only allow request that took place e.g. 10 seconds before. The replay window would be extremly small, and there are no sessions on the serverside.

If the hash is cracked the attacker knows the password and has unlimited access.

Alternative would be to use

HEADER: X-Authentication: timestamp:username:HMAC(password, 'timestamp+request-method+verb')

What's the way to go? I'm not a security pro, maybe storing the session on the server would be better (but not RESTful)?

Upvotes: 3

Views: 786

Answers (2)

Thomas Oeser
Thomas Oeser

Reputation: 128

I built a random hash algorithm that does what you need, it's called jAuthenticate.

You can download it from: https://github.com/thomasoeser/jAuthenticate​

You can see how it works here: http://furiousgryphon.com/jauthenticatedemo.html

The reason it's a strong algorithm (in my opinion) is that I'm using a random number to influence the hash but I'm sending an obfuscated number with the hash.

Each hash is single use only.

Have a look, it's free open source (MIT).

Upvotes: 3

Darrel Miller
Darrel Miller

Reputation: 142024

HTTP authentication is extensible so you can invent your own mechanism (obviously at your own risk!). See https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-p7-auth-20 for details.

Don't bother inventing your own new X- header. Using the existing Authorization header with your scheme is a better option. e.g.

Authorization: kruemel-auth timestamp:HMAC(password, 'timestamp+request-method+verb')

Ideally new schemes will be registered with IANA along with a specification. A registry is being setup to track auth schemes that have been developed. See http://tools.ietf.org/id/draft-ietf-httpbis-authscheme-registrations-03.html

Upvotes: 1

Related Questions