Hi, On Wed, Apr 10, 2019 at 09:40:05AM +0100, Nick Hilliard wrote: > Gert Doering wrote on 10/04/2019 09:22: > > Well, it wasn't clear if "store unencrypted" referred to the client or > > server side. On the server side, yes, please store one-way hashed in > > a secure fashion. > > How though? Again, thinking out loud, it's easy enough if you implement > using an unsalted hash except that's not considered to be secure.
The attack vector against unsalted hashes is "rainbow tables"... make the
API key something like 80 characters long, and no machine in the world
can do anything but brute force.
But why store the API key anyway. Have it contain permissions plus a
crytographically sane signature, and all you need to know is "in the key".
Gert Doering
-- NetMaster
--
have you enabled IPv6 on something today...?
SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer
Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen HRB: 136055 (AG Muenchen)
Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279
signature.asc
Description: PGP signature
