Collaborate Disseminate
I was studying the AWS request signature process and found that they derive the signing key from multiple sources (one and two related questions).
Specifically this:
kSecret = Your AWS Secret Access Key
kDate = HMAC(“AWS4… Continue reading concatenation vs multiple rounds of HMAC
Lets say you are designing a new API. The consumer of your API is a mobile app that periodically sends requests in the background, but you expect other consumers as well, such as web apps or servers.
Now lets consider two sc… Continue reading API protection – JWT vs HMAC signing vs OAuth
I’m studying network security and I found this question in my slide, but don’t have an answer.
Discuss the use of keyed HMACs for guaranteeing the integrity of a
file being transmitted over the network (no other guarant… Continue reading HMAC and integrity
It is my understanding that HMAC is a symmetric signing algorithm (single secret key) whereas RSA is an asymmetric signing algorithm (private/public key pair). I am trying to choose between these 2 methods for signing JSON Web Tokens.
I am very new to authentication and cybersecurity in general, so I apologize if I have anything completely wrong.
My goal is to have the client side hash passwords before sending them to server side in order to protect users… Continue reading Can the username be used in HMAC during client-side hashing?
I am very new to authentication and cybersecurity in general, so I apologize if I have anything completely wrong.
My goal is to have the client side hash passwords before sending them to server side in order to protect users… Continue reading Can HMAC-SHA256 be used with username as a secret key?
We have a scenario where we need to prevent two users from using the same identifier. The identifier is sensitive (e.g. a social security number), so we do not want to store it in our DB. We just want to store some sort of ha… Continue reading Detect duplicates without exposing underlying data
I have discovered a HUGE issue in my code, and I have literally no idea what is causing this.
SO, when I send requests to my server I hash a string thats in the request. This is sometimes user input.
My app is multi langua… Continue reading Swift HMAC doesn’t match NodeJS HMAC, but only sometimes!
We need to host files in Azure Blob Store, and allow access to end users to their generated “statements”(pdf) for a short period of time.
We’re considering achieving this by generating a short-lived SAS token and sending tha… Continue reading Is it safe to share an Azure SAS token with an untrusted client?
I’m new to infosec.
I’m studying about various encryption algorithms.
Based on what I’ve found so far, I think HMAC and Digital signature are almost the same except whether the key is symmetric or asymmetric.
For me, it seems… Continue reading Is HMAC preferable to Digital signature